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ABSTRACT 


As documented by a two-volume report, criteria to determine 
the probability of aircraft structural failure were established 
according to the Quantitative Structural Design Criteria by 
Statistical Methods, the QSDC Procedure. This criteria method 
was applied to the design of the space shuttle during this con- 
tract. An Applications Guide was developed to demonstrate the 
utilization of the QSDC Procedure, with examples of the applica- 
tion to a hypothetical space shuttle illustrating the application 
to specific design problems. Discussions of the basic parameters 
of the QSDC Procedure: the Limit and Omega Conditions, and the 

strength scatter, have been included. Available data pertinent 
to the estimation of the strength scatter have also been included. 


in 



TABLE OF CONTENTS 

SECTION PAGE 


1 INTRODUCTION 1 

2 QSDC METHODOLOGY 3 

.2.1 Intent of the QSDC Procedure 3 

2.1.1 General ....... 3 

2.1.2 Implementation of Intent 7 

2.1.3 Comparison of QSDC Procedure with the 

Present System . . 14 

2.2 Static Design Methodology 16 

2.2.1 Predict Lifetime Operational 

Condition Spectra . . . .16 

2.2.2 Determine Limit and Omega Conditions . . 18 

2.2.3 Determine Limit and Omega Loads .. . . .21 

2.2.4 Compute Design Loads 23 

2.2.5 Design Structure for Design Loads ... 26 

2.2.6- Test Structure to Design Loads 27 

2.2.7 Monitor Lifetime Operational History . . 30 

2.2.8 Redesign and Retrofit 32 

2.3 Time -Dependent (Fatigue) Situations 32 

2.3.1 Intent 32 

2.3.2 Implementation of Intent 35 

3 STRENGTH SCATTER COEFFICIENT 40 

3.1 Definition 40 

3.2 Importance of the Strength Scatter to the 

Design Process 40 

3.3 Estimation of the Strength Scatter ...... 43 

3.3.1 Range Estimation 44 

3.3.2 Baseline Estimation 45 

3.3.3 Estimation by Class 45 

3.3.4 Judgement Estimation . 46 

3.3.5 Preliminary Analytical Technique ... 47 

3.4 Test Data ; 49 

3.4.1 Materials 50 

3.4.2 Structural Elements . 53 

3.4.3 Structural Assemblies . 54 

3.4.4 Compressive Strength Data 55 


v 



TABLE OF CONTENTS (Concluded) 

SECTION PAGE 


4 EXAMPLES , . 5 7 

4.1 Illustration of Design Condition Definition 

by Operational Restriction ..... 57 

4.2 Illustration of Design Condition Definition 

for Noncontrollable Operational Conditions . . 60 

4.3 Illustration of Material Tradeoff Through 

the QSDC Procedure 63 

4.4 Example of Thermal Considerations in Designing 

with the QSDC Procedure 67 

4.5 Illustration of Design Condition Definition 

for Combined Conditions 72 

REFERENCES ...... 76 

APPENDIX A, Summary of QSDC Procedure for Space Shuttle 

Applications A-l 

APPENDIX B. Error Analysis .... 


vi 



LIST OF ILLUSTRATIONS 

FIGURE PAGE 

1 Typical Locations of the Initial Strength 

Distributions for Jablecki Data 9 

2 Typical Locations of the Strength Distributions 

After the Static Test to the Design Load 11 

3 Number and Probability of Exceedance of the Thrust 
per Engine per Vehicle Lifetime (100 Missions) . . 17 

4 Limit and Omega Envelopes for Combined Conditions . 21 

5 Hypothetical Load in the Diagonal Members of the 

Thrust Structure versus the Gimbal Angle 22 

6 Limit Design and Test Factor of Safety (from 

Reference 1) 24 

7 Omega Design and Test Factor of Safety (from 

Reference 1) 25 

8 Design Load Defined by the Larger Strength Scatter 

of Several Components 26 

9 Number of Exceedances of Limit Load per Lifetime 

of the Average Vehicle (5000 hours) 3(3 

10 Warning System Mechanism for Operations Monitoring. 31 

11 Time Dependency of the Fleet Strength Distribution. 33 

12 Structural Reliability of the Design for Various 

Numbers of Fatigue Tests and Multiples of the 
Service Lifetime (from Reference 1) 37 

13 Structural Reliability of the Design for a Fatigue 

Test to the End of the Service Life Followed by a 
Static Test (from Reference 1) .38 

14 Typical Values of the Strength Scatter 47 

15 The Combination of Strength Scatter Factors .... 49 

16 Typical Longitudinal Load Factor versus Time for 

Controlled and Uncontrolled Thrust 58 

17 Typical Probability of Exceedance of Longitudinal 

Load Factor versus Percent Limit Longitudinal Load 
Factor for Controlled Thrust 58 


VI 1 



LIST OF ILLUSTRATIONS (Cont'd) 


FIGURE PAGE 

18 Typical Number and Probability of Exceedance of 

Gust Velocities per Mile of Flight versus Gust 
Velocity 63 

19 Typical Histogram of Number of Failing Articles 

versus Failing Load for Beryllium • . . 65 

20 Typical Beam Loading for Heat Shield Support .... 67 

21 Typical Probability of Exceedance of Entry Velocity. 68 

22 Typical Strength vs. Temperature Curve for the 

Heat Shield Support Material 70 

23 Typical Entry Trajectories 71 

24 Typical Limit and Omega Axial Load Distribution . . — 

25 Typical Limit and Omega Bending Moment Distribution 

for Gust Encounter 73 

26 Typical Spanwise Load Distribution at Body Station 

1500 for Combined Loads (Present System) 73 

27 Typical Spanwise Load Distribution at Body Station 

1500 for Combined Loads (QSDC Procedure) 75 


vm 



LIST OF TABLES 


TABLE PAGE 

I Comparison of Static Design Methodology of 

Present System and QSDC Procedure 15 

II Static Design Methodology of QSDC Procedure .... 16 

III Structural Design Criteria for Static Design in 

the QSDC Procedure 20 


IV Strength Scatter Values Based on Structural Classes 46 

V Strength Scatter Data on Structural Materials ... 50 

VI Strength Scatter Data on Structural Elements ... 53 

VII Strength Scatter Data on Structural Assemblies . . 54 

VIII Strength Scatter Data for Elements in 

Compressive Loading 55 


IX 



1 . 


INTRODUCTION 


Engineers have long recognized a need for reliability-based 
structural design criteria. Present design methods have not 
produced structures that are consistently reliable simply be- 
cause there is no means to consider reliability as a design 
factor. On the other hand, most of the proposed reliability 
methods are not practical in their application as design methods. 
The reliability methods previously proposed have the common fault 
of assuming that the strength distribution of the structure (the 
normal variation of nominally identical structures of a design) 
and the loads to which the structure is subjected are known. That 
is, they do not consider the possibility of an error in the anal- 
ysis such that the actual strength distribution is different than 
the predicted strength distribution. The neglect of the error- 
disclosing ability of a test and the necessity of a proof of 
compliance procedure have also been common. The design procedure 
which can encompass both reliability and the practical aspects 
of the Present System will be the optimum design procedure. A 
design procedure which blends the aspects of reliability and 
practicality into a consistent, useful design procedure has been 
proposed in the "Quantitative Structural Design Criteria by Sta- 
tistical Methods," the QSDC Procedure (Reference 1). 

As a design procedure that can blend reliability with the 
practical aspects of structural design criteria, the QSDC Pro- 
cedure must define design criteria in terms of reliability and 
then translate them into design requirements that can be met 
in a practical design procedure. The QSDC accomplishes this 
by specifying design requirements that interface with the present 
design procedures. That is, deterministic strength requirements 
are specified and must be demonstrated by the appropriate proof 
of compliance procedure. However, the original development of 
the QSDC Procedure as presented in AFFDL-TR-67 -107 discussed the 
basic concepts without developing explicit methodology and the 
necessary data base required for its application. In fulfillment 
of this need, the. Applications Guide was developed. 

The Applications Guide was developed as a handbook that 
structural design engineers could use in implementing the 
QSDC Procedure as a structural design criteria method. The 
QSDC Procedure is presented as a stepwise procedure in which 
the design conditions, design factors, and design loads (strength 
requirements) are specified. Proof of Design is provided by 
appropriate analyses and tests such as those described in NASA 
SP-8057 (Reference 2). Static and fatigue strength requirements 
are discussed in Section 2. Thermal design problems, although 
not discussed here, are outlined in Volume 1. The important 
parameters in the QSDC Procedure are the strength scatter coef- 
ficient and the design and test factor of safety. These param- 
eters and their relation are discussed in Section 3. Also, data 
on the strength scatter coefficient is presented in Section 3. 
Examples illustrating the choice of design conditions and design 


1 



factors can be found in Section 4. These examples are represen- 
tative of the Phase B configuration of the Space Shuttle. Al- 
though care was taken so that the examples would be independent 
of any particular structure, specific design problems were con- 
sidered to demonstrate that the QSDC Procedure is specific in its 
application although it is general in its nature. 
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2 . QSDC METHODOLOGY 


2 . 1 Intent of the QSDC Procedure 

2.1.1 General 


In the implementation of a new design procedure such 
as the QSDC Procedure, it is often helpful to describe the in- 
tent of the procedure. If the new procedure does not cover a 
specific design problem, the engineer can, with an understanding 
of the intent of the procedure, arrive at a solution to that 
particular problem. 

First, the basic intent of any structural design pro- 
cedure should be to ensure that the structure is of sufficient 
strength and reliability to perform its intended function in 
its particular environment for the planned lifetime of the vehi- 
cle. This goal is achieved through the QSDC Procedure by es- 
tablishing a design methodology which will result in structural 
systems that will rarely fail during operations. The QSDC solu- 
tion is designed to take explicit and active measures to prevent 
structural failures for all service conditions ranging in severity 
from zero to infinity. To prevent failures in all possible en- 
vironmental situations, the design spectrum is subdivided into 
three separate operational regions as shown in Appendix A (Figure 
2, page A-6) . Failure is then prevented in each region. These 
three regions - safe, overload, and gross overload - are delimited 
by two deterministically defined operational conditions: the 
Limit Condition and the Omega Condition. 

These two conditions are intended to represent inter- 
faces between the structural and non-structural systems. The de- 
termination of the Limit and Omega Conditions is described in 
detail in Section 2.2.2. The intent behind the choice of the 
two conditions is summarized below. 

The Limit Condition is intended to be the upper boundary 
of normal and expected operations of the vehicle and its non- 
structural subsystems. This qualitative definition is quantitized 
in the QSDC Procedure as discussed in Section 2.2.2. For instance, 
the Limit Condition might be defined as a 2a or a one- in-one-hundred 
condition. For all practical purposes, the Limit Condition in 
the QSDC Procedure is intended to be the same as the Limit Con- 
dition in the Present System (represented by Reference 2) . Since 
a Limit Condition is normal and expected, it should be permissi- 
ble to operate at all operational levels up to and including 
the Limit Condition. Typically, operational limitations and plac- 
ards are related to Limit Conditions. 

Since the Limit Condition is a permissible condition, 
it should be structurally "safe" to operate up to the Limit 
Condition. Thus, the Limit Condition has the characteristic of 
an interface between the structural and non-structural systems. 
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The non- structural system may be operated up to Limit with every 
expectation that structural survival is "certain" and will re- 
sult in operations that are "safe." If a structural failure 
should occur at an operational condition below Limit, respon- 
sibility for the failure must be attributed to the structural 
sys tern. 


The Omega Condition is intended to represent the most 
extreme or severe operational condition for which some degree of 
structural capability is required. Operations beyond Limit must 
be considered as overload situations imposed on the structural 
system by the non-structural system. The Omega Condition is in- 
tended to establish a bound on the overload from non-structural 
systems that the structural system must tolerate and survive. 

Any operation beyond the bound established by the Omega Condition 
is considered to be a gross overload and is not expected to be 
survivable. 


Although the Omega terminology is new, the concept of 
providing structural capability beyond the Limit Condition is not. 
The 1.5 Factor of Safety that is typical in the Present System 
provides some overload capability although the amount varies from 
one design to the next. The QSDC Procedure differs from the 
Present System only by making the overload requirement explicit. 
The QSDC Procedure rationalizes the overload requirement by link- 
ing it to a structural reliability requirement. This rationali- 
zation of the overload requirement can be understood and accepted 
if it is realized that the average structure in a fleet must 
survive (to a first approximation) a flight condition that occurs 
once in the lifetimes of a 1000 vehicles if a 0.999* reliability 
is to be attained. Conversely, it is not necessary to provide 
more strength than enough to survive an operational condition 
which is the complement of the desired structural reliability. 

Thus, the intent in establishing the Omega Condition 
in the QSDC Procedure is to define an upper bound on operational 
mode for which some capability of surviving structurally is re- 
quired. Since the structure is not required to survive beyond 
the Omega Condition, the vehicle must not exceed this condition 
too often or the structure may fail so often that the structural 
reliability goal cannot be met. 

The requirements for the structural system are related 
to the Limit and Omega Conditions in the QSDC Procedure. As 
noted in the discussion of the Limit Condition, the QSDC Procedure 
intent is to define requirements that will result in a structural 
system which is "safe" if the Limit Condition is not exceeded. 
Reference 1 quantitatively defines a structure which is "safe" 
in the region up to the Limit Condition as one which has no more 
than one percent of its total failure distribution below the 


* Typical numbers. Specific values depend on vehicle mission 
as discussed in Section 2.2.2. 
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Limit Condition. This means that, for any specified reliability 
goal, the contribution to the failure rate will be insignificant 
in the "safe" region. There should be no more than one failure 
in the "safe" region below the Limit Condition for every 99 fail- 
ures in the overload regions above Limit. 

The desired high degree of certainty of survival in 
the "safe" region is obtained in the QSDC Procedure by designing 
and testing to the Limit Loads multiplied by a factor of safety 
known as the Limit Design and Test Factor of Safety (LTFS) . This 
is essentially the same procedure as that in the Present System. 
The difference is that the LTFS in the QSDC Procedure is not 
a fixed value such as 1.5 but a variable dependent on (1) the 
reliability goal as defined by mission, (2) the strength scatter, 
and (3) the number of strength tests of the particular structural 
configuration (see Figure 6). It is the intent of the QSDC Pro- 
cedure that the factor of safety (LTFS on Figure 6) be the mini- 
mum value required to attain a "safe" structure. Since the 
overload capability is provided separately, the requirement for 
"safe" structure up to the Limit Condition can be established 
without consideration of overload capability and total probability 
of failure. 


References 3 and 4 together with Section 2.1.2 and 
Appendix B of this report discuss the possibility of errors in 
the strength analysis. A basic premise in the QSDC Procedure 
is that the frequency and magnitude of analytical errors are 
major contributors to structural unreliability. The desired 
level of structural reliability is regained by strength tests 
which disclose any errors with a high degree of certainty. The 
error disclosure results in rejection of the unreliable design 
followed by redesign and retest until the test requirements are 
satisfied. 


The LTFS of Figure 6 is intended to define design and 
test loads incremented upward from Limit Loads sufficiently 
so that a service vehicle will "never" fail at the unfactored 
Limit Load after being tested to the higher design loads factored 
upward by the LTFS. Reference 1 describes how the LTFS is cal- 
culated. Oversimplified, it is determined by the range between 
the high side and the low side of the strength distribution of 
the particular structural system. There is a finite possibility 
that an understrength design might pass the static test because 
the test article is randomly on the high side of the actual mean 
strength. This situation is sometimes called "random success." 

Such an understrength design would be approved for production, 
not knowing that the design is understrength and that the mean 
strength is below the test strength. Some of the flight articles 
would inevitably be below the mean strength which is already 
below the test strength. To attain a "safe" design, one with 
a very low probability of failure at Limit, the chance must be 
minimized of a random success on the high side of the true strength 
distribution resulting in the qualification of an understrength 
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structural design which is followed by a random low side failure 
of one of the operational vehicles. The larger the strength 
scatter, the larger the range between the high side and the low 
side at a given probability level. This is the underlying reason 
why the LTFS must increase as the strength scatter increases 
as shown on Figure 6. 

Designing and testing as necessary to attain a struc- 
tural configuration which is "safe" up to the Limit Condition 
will not necessarily result in the desired total probability of 
failure and overall structural reliability. The total proba- 
bility of failure is related to the frequency and magnitude with 
which the Limit Condition is exceeded operationally. Reference 
1 establishes that in most situations structures which are de- 
signed and tested to the loads corresponding to the Omega Condi- 
tion will intrinsically have a probability of failure less than 
the probability of exceedance of the Omega Condition. However, 
when the strength scatter is large, the structural reliability 
starts dropping if the test load is the same as the load associ- 
ated with the Omega Condition. As shown on Figure 7 a separate 
factor of safety (OTFS) must be applied to the Omega Loads 
when the strength scatter is large. 

If the intent of the QSDC Procedure is accomplished, 
the resulting structural system will satisfactorily perform 
its function as a vehicle subsystem. The structure will be "safe" 
and "never" fail in the operational region up to the Limit Con- 
dition. Since this region is by designation the region of normal 
and expected operations, almost all operational situations oc- 
curring in actual usage will be in this "safe" region. 

The intent of the QSDC Procedure is that a negligible 
proportion of the total probability of failure distribution will 
occur in the region below the Limit Condition. Therefore, the 
major contribution to the total probability of failure will result 
from operations in the overload and gross overload regions (see 
Figures 2 and 4 of Appendix A) . Regardless of the calculated 
probability of failure based on the predicted probability of ex- 
ceedance of the Limit Condition, any failure beyond the Limit 
Condition is the result of an operational overload. The first 
and best line of defense against such, failures is to conduct 
service operations of the vehicle and its non-structural subsys- 
tems so that the designated Limit Condition will not be exceeded. 
If the effort to prevent overload operations is successful, the 
Limit Condition requirement, designing for Limit Loads multiplied 
by the LTFS, will provide for "safe" operations. 

If the Limit Condition is penetrated and overload oper- 
ations do occur, the second line of defense is the overload capa- 
bility of the structural system provided by the Omega Condition 
requirement. The intent of the QSDC Procedure is to define Omega 
requirements which result in a structural system with "most" of 
the operational vehicles capable of surviving a penetration of the 
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overload region between the Limit and the Omega Conditions. "Most" 
is used to define the requirement since penetration into the over- 
load region will be rare, and if "most" vehicles survive the pene- 
tration, failure will be very rare in this region. 

If the penetration of a Limit Condition continues 
beyond the Omega Condition, survival of the structure is not 
likely. It is the intent of the QSDC Procedure that prevention 
of structural failure due to a gross overload caused by opera- 
tion beyond the Omega Condition should not be the responsibility 
of the structural system. Prevention of structural failure in 
the gross overload region beyond Omega is the responsibility of 
the non-structural system interfacing with the structural system. 

If operations can be conducted so that the Omega Condition is 
never exceeded or, at worst, so that the frequency or probability 
of exceedance is no more than originally predicted when the Omega 
Condition was established, then the probability of failure and 
structural reliability will be as originally predicted. 

2.1.2 Implementation of Intent 

The intent described in the previous section must be 
carried out by specific actions if the "no failure" goal is to 
be attained while minimizing the structural weight and cost 
necessary to achieve the goal. 

The first step in implementing the intent of the QSDC 
Procedure is to establish a deterministic interface between the 
structural and nons tructural systems. This interface is defined 
by the dual level of operational conditions. The determination 
of the dual (Limit and Omega) conditions is discussed in Section 
2.2.2. Prediction of the lifetime operational spectra on which 
the determination of the Limit/Omega Condition should be based 
cannot be expected to be perfectly accurate. Therefore, the 
QSDC procedure is intended to translate the definition of the 
Limit/Omega Conditions into operational limitations and perfor- 
mance requirements for nonstructural systems. Those responsible 
for the design and operation of any nonstructural system inter- 
facing with the structural system must be appraised of the mag- 
nitude of the Limit Condition. They, in turn, must be respon- 
sible for not exceeding the Limit Condition. When exceedances 
do occur, it is the intent of the QSDC Procedure that there be 
an advance commitment that each instance of exceedance of a Limit 
Condition be investigated and corrective action taken to prevent 
future exceedance.* It should never be forgotten that structural 
failure can be caused, as shown on Figure 1 of Appendix A, by 
excessively severe operations resulting in overloads. Control of 
operations is equally important with control of strength in pre- 
venting structural failures. 

— ■ — 

Naturally, a system would be required to monitor the vehicle 
operation so that exceedances of Limit could be detected. 
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The intent of "no failure at Limit" is achieved by 
designing and testing (in most cases) to loads which are higher 
than those at the Limit Condition. The increment beyond Limit 
provides a reserve against understrength so that any design which 
is tested to the specified loads will "never" fail in operations 
at Limit. The required increment is defined in the QSDC Proce- 
dure as a Limit Design and Test Factor of Safety (LTFS) . It is 
explicitly tailored to be the minimum value commensurate with the 
structural reliability goal for the particular mission. As 
shown on Figure 6, an LTFS less than 1.5 may be justified in 
many cases but larger values may be necessary in other cases. 

In the past, the conventional 1.5 F.S. has provided 
this necessary reserve against understrength generally with good 
success. However, it has done so indirectly, not as the result 
of a specific requirement. In some instances the 1.5 factor has 
been more than necessary and in other cases it has not been 
enough to provide the desired reliability. In such instances, 
past procedures have proscribed such situations. For example, 
long slender columns are not permitted in aerospace structures 
according to MIL-HDBK-5A; pressure vessels usually require a 
factor of safety greater than 1.5; and brittle materials such 
as ceramics and extremely high heat treatments are not used 
in primary structures. 

If the reserve against understrengths were to be ig- 
nored, as some investigators have proposed, the result is very 
likely to be an unsafe structure. For example, with no errors 
in the analysis and fabrication, the specification of a factor 
of safety of 1.0 would, by present methods, result in a failure 
rate of one per hundred vehicles at or below Limit. Since the 
present method matches the "A" allowable (99 percent exceed) of 
the material strength with the required strength (the load 
at Limit), the one - in-one -hundred strength that did not exceed 
the "A" allowable would certainly fail below Limit. Some in- 
vestigators have not considered the effect of the factor of 
safety in light of the reserve against this understrength. They 
have claimed that the factor of safety is necessary to compensate 
for errors. However, in the previous discussion where no errors 
are considered, the result is still an unsafe structure when 
a 1.0 factor of safety is used. Therefore, the factor of safety 
is used to account for another phenomenon: that of the normal 

variation or scatter in the strength of the material. 

Unfortunately, the problem of designing a structure to 
be "safe" at Limit is more serious than indicated in the preceding 
paragraph. Reference 1 points out the difficulty of achieving a 
"safe at Limit" design when the possibility of an analytical error 
in the strength analysis is considered. If the Jablecki/Chenoweth 
data (References 3 and 29) are accepted as valid, approximately one 
in ten of the analytically qualified designs would fail at Limit 
(assuming a 1.5 F.S.). 
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The possibility of these failures can be demonstrated by 
Figure 1 where the strengths of an inventory of 20 new designs 
are shown. The strength distribution of each design is shown as 
a percentage of the Limit Load. These values for the strength dis- 
tributions are based on the Jab lecki/Chenoweth data and represent 
the initial, untested strength distributions of the design. In 
keeping with the one-in-ten design failures below Limit, 2 of 
the 20 design strength distributions, E and K, have their mean 
strength at or below the Limit Strength. Similarly, the 12 
strength distributions whose mean strengths are below 150 percent 
of the Limit Load level (designs B, D, E, G, I, K, L, N, P, Q, 

S, and T) represent the 50 percent of the structural designs 
that will fail below the Design Load. To substantiate the per- 
centages used, reference is made to Figure B-2 where the Jablecki/ 
Chenoweth data are presented. Specific percentages of the design 
load have been assigned to specific designs for illustrative 
purposes only. It is pointed out that the underlying assumption 
of the QSDC Procedure is that the actual location of a design 
strength distribution is never known with certainty. For example, 
when a particular system such as the space shuttle is considered, 
the strength distribution of the design may be that of design A; 
but it could be like the strength distribution of design N, or 
worse yet, like the strength distribution of design K. Given a 
single strength test, it cannot be said with certainty that the 
strength distribution of the space shuttle is that of design A; 
instead, in the QSDC Procedure the statement is allowed that 
the strength distribution of the space shuttle is probably that of 
design A. The probability that the strength distribution is below 
the intended location must be considered if a "safe" structure is 
to be designed. 



Figure 1. Typical Locations of the Initial Strength 
Distributions for Jablecki Data 
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The assumption that space shuttle designs will be as 
error-prone as the aircraft designs resulting in the Jablecki/ 
Chenoweth data is argumentative. However, available evidence 
indicates that the assumption is valid. In any event, it is 
a basic assumption of the QSDC procedure that the strength anal- 
ysis alone will not result in the high degree of certainty neces- 
sary to be sure that a new design will be "safe" at the Limit 
Condition. References 1 and 5 state the need for designing and 
testing a design to loads greater than the loads associated with 
the Limit Condition. The magnitude of the factor depends on 
the level of structural reliability desired, the coefficient 
of strength scatter, y s (see Section 2), and the number of strength 
tests to be conducted to qualify the design. Figure 6 shows 
the recommended value of this factor of safety. It is called 
the Limit Design and Test Factor of Safety (LTFS) to distinguish 
it from the well-known 1.5 factor of safety. 

References 1 and 5 discuss in detail the rationale 
for the LTFS values shown on Figure 6. Oversimplified, the LTFS 
is associated with the certainty that the strength qualifica- 
tion test will reveal a deficient design by a failure below the 
required test load. The certainty of rejection is related to 
the "random success" phenomena. This means simply that the test 
article may be stronger than the average strength of nominally 
identical articles. Therefore, an understrength design may pass 
the qualification test. The possibility that operational vehicles 
may fail at Limit after successfully passing a test to some higher 
load depends on the range in strength from the high side to the 
low side of the distribution of nominally identical structures. 

Thus, the larger this range in strength, as defined by y s , the 
larger the factor of safety necessary to assure "no failure" at 
Limit. Consequently, the factor of safety is a function of the 
scatter in strength as shown in Figure 6. 

The degree of certainty required so that the new design 
will be safe at the Limit Condition can be insured by performing 
a strength test to the design load. The disclosure of the under- 
strength designs (B, D, E, I, K, L, N, P, S, and T) is shown in 
Figure 2. The short vertical line placed on the strength distri- 
bution represents the failing strength of the strength test arti- 
cle. When the strength of the test article is surpassed in the 
test, the article fails and the design is considered unacceptable 
(marked by an X on Figure 2). The structure must be redesigned 
and retested until the test article passes the test to the design 
load; i.e., the test article strength is greater than the design 
load. When this situation occurs, the design is qualified (the 
design strength distribution is crosshatched in the figure to repre- 
sent the qualified design) . 

The anomalies that can occur in the strength test are 
illustrated by designs C, G, and Q. For design C, the strength 
distribution of the design is satisfactory before the test is 
conducted, but the strength of the test article is randomly on 


10 



the low side of the strength distribution. As a result, the test 
article fails at less than the Design Load and hence the design 
fails to qualify. (This phenomenon is known as random failure.) 
The design must be strengthened as a result of the test failure 
thus strengthening an already satisfactory design. The disad- 
vantage of the random failure is only in the added program cost 
for the redesign, retest, and additional weight. Design G repre- 
sents the opposite phenomenon: that of random success. The 

strength distribution of the design is less than that intended, 
but the test article is randomly on the high side of the strength 
distribution. Thus, a design that is slightly understrength 
passes the strength test and is qualified. However, the Refer- 
ence 1 data shows that minor understrengths such as in design G 
do not result in a significant loss in structural reliability. 



Figure 2. Typical Locations of the Strength Distributions 
After the Static Test to the Design Load 


Design Q is a repetition of the random success pheno- 
menon. The only difference is that the degree of the design 
understrength is much greater. The design Q is included so that 
the effect testing has on the certainty of having a "safe" de- 
sign at the Limit Condition can be demonstrated by a simple 
example. It is assumed that the factor of safety is 1.5 and 
that the structural configuration results in a typical strength 
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scatter (coefficient of strength variation equal to 0.05). If it 
is assumed that an error in the analysis results in a structure 
whose mean strength is midway between the Limit and Ultimate Loads 
(Reference 1 points out that this midpoint location of the mean 
strength is the worst possible case) . A successful test to 150 
percent of Limit Load would occur only once in 31,500 such situa- 
tions.* This l-in-31,500 design, which happened to pass the test 
to Ultimate Load, would qualify the design and make it acceptable 
for production. Based on the location of its mean strength, the 
probability of a service vehicle failing at Limit would also be 
l-in-31,500. As a result, the probability of failing at Limit after 
a successful test to 150 percent Limit is the product of the two 
probabilities or approximately one in one billion. In the QSDC 
Procedure this very low probability is considered equivalent to 
"no" failure. It appears that the rationale outlined above explains 
why strength tests to 150 percent of Limit Load have resulted 
in very reliable structural systems in the past. 

The intent of the QSDC Procedure as described has been 
limited to structural reliability as defined by the prevention 
of catastrophic rupture or collapse of the structural system. 

Yield in the structure in the region up to Limit has traditionally 
been considered to be unacceptable. However, yielding in the 
structural system does not normally cause loss of the vehicle 
or loss of life. Generally, yield failures result in economic 
consequences only. The cost reflects the loss of vehicle util- 
ity during a mission or the cost of repairing or replacing a 
yielded component. Therefore, the certainty of surviving up 
to the Limit Condition without yield may be much less than the 
certainty of surviving Limit without catastrophic failure. 

If a structural reliability goal based on survival 
without yield can be defined, the yield factor of safety can be 
developed in the same manner as the LTFS for ultimate or catas- 
trophic failure as defined on Figure 6. The determination of 
specific values for the yield factor of safety is beyond the scope 
of the present study. However, it appears reasonable to assume 
that the reliability against the yield mode of failure could be 
about one-half that reflected by the "high-risk" curve of Figure 
6. The strength scatter used to define the yield factor of 
safety would, of course, be the scatter in yield strength. On 
the basis of this crude analysis, the 1.1 factor of safety some- 
times specified for yield would be quite adequate unless the 
scatter in yield strength is quite large. The 1.0 yield factor 
of safety may result in a moderately high probability of accepting 
a design that will experience some yield failure during operations. 
For instance, if the actual mean strength happens to coincide 
with the Limit Load, there will be a 50 percent probability that 
the test article will pass the test for yield strength. If such 
a design is accepted, there will be a 50 percent probability that 
the operational vehicles will experience yield at Limit. Thus, 


* Gaussian distribution assumed with mean at 125 percent Limit. 
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a yield test to a 1.0 factor may result in a 25 percent proba- 
bility of operational yield failure after successfully qualifying 
the design by demonstrating with one test article that there 
is no yield at Limit. It is suggested that a trade study be 
conducted on specific designs to determine the break-even yield 
factor of safety, balancing the cost of designing and testing 
to higher yield factors against the increased probability of 
yield failures on operational vehicles associated with lower 
yield factors. In the absence of such a trade study, a 1.1 yield 
factor of safety is recommended. 

Implementation of the intent of the QSDC procedure 
thus far has been in the context of static or time - independent 
strength situations. This has traditionally been the prime 
strength requirement. After satisfaction of the static strength 
requirement, the usual procedure is to examine the structural 
configuration to determine whether it satisfies the requirement's 
for time -dependent strength situations. Historically, the first 
time-dependent strength situation to be considered was fatigue. 
The intent of the QSDC Procedure is the same in the fatigue sit- 
uation as in the static situation where the Limit Condition is 
the static strength requirement, and the Limit Usage Spectrum 
defines the time -dependent strength requirement. Any cumulative 
vehicle usage which can be defined as normal and expected must 
have "no" failure so long as the vehicle does not exceed the de- 
fined Limit Usage Spectrum or the defined Limit Condition during 
the defined Service Life. 

An Omega Usage Spectrum defines a usage whose proba- 
bility of exceedance is greater than the complement of the 
desired structural reliability. An Omega Usage Spectrum may 
result either from excessively severe operations during the 
expected or specified Service Life or from the specified normal 
usage carried on beyond the specified Service Life to an unex- 
pectedly long life, the Omega Service Life. "Most" of the 
operational structural systems should be capable of surviving 
an Omega Usage Spectrum. 

The intent of the QSDC Procedure in time -dependent 
strength situations is the same whether the time dependency is 
the result of fatigue, thermal, corrosion, or other similar con- 
ditions. The cumulative usage history of the vehicle is the 
interface between the structural system and the non-structural 
systems. The local environments are derivatives of the vehicle 
usage . 


The intent of the QSDC Procedure in time -dependent , 

situations is presumably the same as that of the Present System. 
Both procedures aim at defining a structural system which will 
not experience structural failures during the life of the vehicle. 
However, there is a fundamental difference in the achievement of 
this goal. The QSDC Procedure examines the degraded or residual 
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strength during the vehicle lifetime and determines how this af- 
fects survival of Limit and Omega Conditions. The Present Sys- 
tem effectively ignores the strength during the Service Life 
and concentrates on surviving a truncated loading spectrum to 
some multiple of the specified service life. If this approach 
produces a reliable structure during the service life, it is 
somewhat fortuitous because the relationship between the test 
life and the actual strength during the service life is not 
considered. In the QSDC Procedure the strength during the service 
life is considered directly. In particular, the problem of re- 
jecting a design which has inadequate strength during the service 
life is a prime consideration. 

2.1.3 Comparison of QSDC Procedure with the Present System 

The QSDC Procedure, although presented as a new design 
procedure, is in reality a modification of the Present System. 

In particular, it is a modification of the choice of the design 
conditions. The implementation of these conditions, their use 
in the design of the actual piece of hardware, is the same as 
that in the Present System. Despite their differences, several 
comparisons and contrasts may help the user to better understand 
the new procedure. 

First, the Limit Condition of the QSDC Procedure is es- 
sentially the same as that of the Present System. However, the 
definition of the Limit Condition in the QSDC Procedure is based 
on a probability of exceedance value, whereas the definition of 
the Limit Condition in the Present System is deterministically 
based on previous experience or the engineer's judgement, or both. 
The objective of either definition is to make the Limit Condition 
the upper boundary of normal and expected operations. 

Second, the Omega Condition of the QSDC Procedure is 
used to fulfill a single part of the dual role of the Present 
System's Ultimate Load. The part that the Omega Condition ful- 
fills is to define the required overload capability of the struc- 
ture. By virtue of the fixed 1.5 factor of safety, the ultimate 
load is higher than the Limit Load associated with the Limit 
Condition. The vehicle overload capability that this provides 
is indirect and not really a requirement that must be fulfilled. 

As a result, the degree of vehicle overload capability is not 
known. On the other hand, by specifying a discrete Omega Condi- 
tion, the degree of overload capability that the design will 
have is known. This overload capability is insured by the use 
of an Omega Design and Test Factor of Safety (OTFS) . In most 
applications, this factor equals 1.0, but if the scatter factor 
or the reliability required are large, the OTFS is increased 
according to the curves of Figure 7. 

Third, the QSDC Procedure defines requirements intended 
explicitly to result in a structural system which is "safe" up 
to the Limit Condition. The Present System satisfies this "safe" 
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requirement indirectly and with varying degrees of certainty. 
Situations where the system might not have the desired degree of 
reliability at Limit have been recognized through experience and 
handled by empirical requirements . 

Fourth, the loads associated with the Omega Condition 
are not factorially related to the loads associated with the 
Limit Condition. In some special situations the Limit and Omega 
Loads may be identical, for example, when the vacuum in a tank 
approaches absolute zero at the Limit Condition. The vacuum 
in the Omega Condition will also approach zero. It should be 
clearly understood that the Limit and Omega Loads are determined 
directly from the Limit and Omega Conditions. To emphasize this 
relationship, it is possible for the wing bending moment in the 
Omega Condition to be less than the bending moment in the Limit 
Condition. This situation could result from nonlinearities in 
the wing load distribution associated with partial stall conditions. 

The similarity between the QSDC Procedure and the 
Present System is emphasized on Table I. The major procedural 
differences are the addition of Omega Conditions to the design 
requirements and the adoption of a factor of safety that varies 
from one design to another. A detailed explanation of each 
step on Table I is presented in Section 2.2., Static Design 
Methodology. 

TABLE I. COMPARISON OF STATIC DESIGN METHODOLOGY OF 
PRESENT SYSTEM AND QSDC PROCEDURE 


1. PREDICT LIFETIME OPERATIONAL CONDITION SPECTRA 

2. determine LIM|T Iomega conditions. 

3. DETERMINE U MIT iwD OMEGA L0ADS - 

4. COMPUTE tK A ^D o T MEGA EDESIGN L0ADS - 


5. DESIGN STRUCTURE FOR DESIGN LOADS. 


6. TEST STRUCTURE FOR DESIGN LOADS. 

7. MONITOR LIFETIME OPERATIONAL HISTORY. 

8. REDESIGN AND RETROFIT. 


# WHERE THE TOP LINE REFERS TO THE PRESENT 
SYSTEM DESIGN METHODOLOGY AND THE BOTTOM LINE 
REFERS TO THE QSDC PROCEDURE DESIGN 
METHODOLOGY 
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2 . 2 Static Design Methodology 

The QSDC Procedure satisfies the intention of insuring "that 
the structure is of sufficient strength ... to perforin its intended 
function..." through its static design methodology. The static 
design methodology may be summarized as a series of eight steps, 
listed in Table II, that describe the choice and implementation 
of the Limit and Omega Conditions mentioned in Section 2.2.2. 
Steps 1 and 2 define the Limit and Omega Conditions for design 
purposes. Steps 3 through 6 are concerned with the analytical 
determination of the design loads, the strength of the structure, 
and the strength tests necessary to qualify the design. Steps 
7 and 8, although not directly concerned with the initial design 
and fabrication of the vehicle, are concerned with the effective- 
ness of the design in operation. 


TABLE II. STATIC DESIGN METHODOLOGY OF QSDC PROCEDURE 

1. PREDICT LIFETIME OPERATIONAL CONDITION SPECTRA 

2. DETERMINE LIMIT AND OMEGA CONDITIONS. 

3. DETERMINE LIMIT AND OMEGA LOADS. 

4. COMPUTE LIMIT AND OMEGA DESIGN LOADS. 

5. DESIGN STRUCTURE FOR DESIGN LOADS. 

6. TEST STRUCTURE FOR DESIGN LOADS. 

7 MONITOR LIFETIME OPERATIONAL HISTORY. 

8. REDESIGN AND RETROFIT. 


2.2.1 Predict Lifetime Operational Condition Spectra 

Aerospace systems are designed to fulfill particular 
program objectives. These objectives are generally embodied in 
a "design mission" and alternate design missions. As soon as the 
"design mission" is defined, a corresponding set of operational 
conditions are described (as in Reference 2) as phenomena, or 
events , that may occur at a point in time or interval thereof 
and are expressed in terms of physical units such as pressure, 
temperature, load, acceleration, attitude, rate, and flux. For 
example, the design mission of the Space Shuttle might be simply 
stated as placing 65,000 pounds of payload in orbit and re-entering 
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the atmosphere aerodynamical ly . Some hypothetical operational 
conditions consistent with this mission might be a nominal thrust 
level of 800,000 pounds, a longitudinal acceleration of 35.4 feet 
per second squared to 218 feet per second squared and an entry 
velocity of 16000 feet per second at 200,000 feet. The role 
of the responsible engineer will be to define and predict these 
and other operational conditions. 

The engineer must not only predict the range of opera- 
tional conditions, but he must also determine the probability of 
exceeding each level of the condition in the range. As an example, 
consider the operational condition of booster thrust. The entire 
range of booster thrust could theoretically be zero pounds-force 
to an infinity of pounds-force. Defining this range in terms 
of probability would then permit considering a much smaller 
range. Assuming that it has been determined by one of the 
following methods, a thrust of 1 x 10° pounds will be exceeded 
once in one hundred vehicle lifetimes as shown on Figure 3. 
Similarly a thrust of 1.2 x 10° pounds-force will have been 
determined as exceeded once in ten thousand vehicle lifetimes, 
also shown on the figure. This process of assigning a proba- 
bility of exceedance to every level is continued until a smooth 
curve can be drawn. The assignment of the probability of 
exceedance was made on an average vehicle lifetime basis. In 
defining the range of operational conditions, this convention 
should be adhered to so that the design condition levels used 
in the next section will be consistent. 



Figure 3. Number and Probability of Exceedance of the Thrust 
per Engine per Vehicle Lifetime (100 Missions) 
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Methods that can be used to assign the probability 
to a given condition level would be as follows: a synthesis 

of the condition spectrum from an analysis of the statistics 
of past operations with similar vehicles, an analysis of the 
operational capabilities of the vehicle and the performance 
requirements during each phase of the vehicle life, or good 
engineering judgement. 

2.2.2 Determine Limit and Omega Conditions 

The Limit Condition of the QSDC Procedure is a deter- 
ministic value that represents the upper boundary of normal and 
expected conditions for a given operational parameter. As a 
limit, the condition level used is a placard value that is, 
by decree, not to be exceeded. As such, the Limit Condition 
provides an administrative criteria when structural failure 
and operational control are considered. When structural failure 
below the Limit Condition occurs, the controlling agency can 
order the structural organization to strengthen the structure. 
When exceedances of the Limit Condition occur, the controlling 
agency can order the non-structural systems to control the oper- 
ations so that future exceedances do not occur. Without a de- 
terministic Limit Condition, such decisions cannot be made. 

For example, if the Limit Condition were defined in probabilistic 
terms, the failure or exceedance could always be attributed to 
the random variation. For instance, a structural failure at 
90 percent of the usual Limit Condition could be attributed to 
a one-in-a-thousand low-strength structure, with the remainder 
of the structures predicted to fail above the Limit. Similarly, 
one occurrence of an operational condition of 120 percent of 
the usual Limit Condition could also be considered a random 
event with a one-in-ten-thousand probability but not an unaccep- 
table one-in-ten probability. Neither of these statements can 
be proved or disproved. The structural failure could not be 
categorized as an understrength situation, nor could the opera- 
tional condition be categorized as an overload. Therefore, 
an administrative decision on whether corrective action was 
needed would not be evident. Therefore, no control over the 
design could be exercised. 

The Omega Condition in the QSDC Procedure is a deter- 
ministic value that represents the boundary between what is 
considered a minor overload and what is considered a gross over- 
load. Its role in the QSDC Procedure is the definition of an 
acceptable overload and the absolute boundary of the strength 
requirement for the structural system. Basically, there is 
no similar condition specified in the Present System, but the 
Ultimate Load creates .some overload capability. The Omega Condi- 
tion, like the Limit, is deterministic and single valued. Al- 
though the difference between an acceptable overload and a gross 
overload could encompass a wide range of values, a single value 
is again chosen for administrative purposes. As before, specific 
actions concerning the structural failure and condition of ex- 
ceedances can be taken by the controlling agency. Structural 
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failure above the Omega Conditon can be attributed solely to 
the gross overload of the structure by the non- structural system. 

In the QSDC Procedure, the choice of Limit and Omega 
Conditions is made on the basis of the probability of exceedance 
of the condition level. Thus, the Limit and Omega Conditions are 
two precise points in the spectra defined in Section 2.2.1. The 
probabilities at which these two points are defined are themselves 
based on the structural reliability goal proposed for the structure. 
Two specific equations relating the probability of exceedance of 
the Limit and Omega Conditions to the S.R. goal are: 

c n /(p E [c n ] - /FITqrn 

= C n /(Pp[C n ] 1 SRgoal) 

where 

C^ is the Limit Condition 

C^ is the Omega Condition 

C n is the general condition that satisfies 

the equations 

Pp is the probability of exceedance and 

SRgoai is the structural reliability goal. 

NOTE : 

Read the Limit Condition (Cl) equals the variable condition 
level (C n ) such that the probability of exceeding the variable 
condition level ...Pp[C n ] equals the square root of the proba- 
bility of exceeding the Omega Condition (C^) ; also the Omega 
Condition equals the variable condition level (C n ) such that the 
probability of exceeding the variable condition level equals the 
complement of the structural reliability goal. 

If all of the operational conditions can be defined in 
terms of their probability of exceedance, then the QSDC Procedure 
provides a consistent, practical, and reliable method for choos- 
ing the Limit and Omega Conditions. 

The reliability level used as the basis for the parti- 
cular design being considered is a management decision that is 
required by the QSDC Procedure. This decision is based on the 
mission specified for the vehicle system and the performance re- 
quired of the structural system to satisfactorily complete the 
vehicle mission. . Alternatively, the reliability level can be 
defined for each class of vehicle or by risk level, as on Table 
III. Here, a high risk level mission, such as military missions 
might describe, would have a structural reliability of 0.99. 

Such a low level of reliability is practical because of the high 
probability of structural failure due to hostile action and the 
extremes of operating conditions that the structure is subjected 
to in combat action. A standard risk mission, which has a cor- 
responding structural reliability of 0.9999, would be specified 
by the typical space operations but could be modified as the 
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situation warrants. Low risk missions that require a structural 
reliability of 0.999999 are typified by the commercial, passenger- 
carrying flights on commercial airlines. The above three levels 
of reliability are proposed because they typify the expected 
values of reliability desired. Precise reliability goals of 

0. 999998, etc., are basically not practical choices because the 
exact reliability of any single design can never be known. How- 
ever, the reliability can be estimated fairly closely. As a re- 
sult, approximate figures can be specified. If the design steps 
are followed properly, the reliability that the design will have 
should be close to the reliability specified. For example, 

if a 0.9999 reliability is specified, the actual reliability 
of the structure should be somewhere in the vicinity of 0.9999, 

1. e., 0.9995 to 0.99995. This is one reason why the QSDC Pro- 
cedure sets reliability goals rather than reliability require- 
ments . 


TABLE III. STRUCTURAL DESIGN CRITERIA FOR STATIC DESIGN 
IN THE QSDC PROCEDURE 


RISK 

LEVEL 

STRUCTURAL 

RELIABILITY 

GOAL 

PROBABILITY OF 
EXCEEDING LIMIT 
CONDITION 

PROBABILITY OF 
EXCEEDING OMEGA 
CONDITION 

HIGH 

.99 

.1 

.01 

STANDARD 

.9999 

.01 

.0001 

LOW 

.999999 

.001 

.000001 


When the structure is critically loaded by a combi- 
nation of operational conditions, the combined spectrum should 
be considered. The specification of Limit and Omega Conditions 
becomes more complex, but the definition remains the same. 
Normally, only independent operational conditions are combined; 
dependent conditions will need special consideration. Indepen- 
dent condition spectra are combined to form Limit and Omega 
Condition envelopes. The envelope performs the same role as 
the point in the single condition case: that of defining a 

distinct boundary. The Limit envelope is defined as the region 
of combined conditions less than or equal to the Limit of one 
or all conditions. For the two-condition case, the region is 
bounded by the points 0,L^, L]^ + 2 , L 2 of Figure 4. The L imi t 
envelope is defined by the area enclosed by lines: , fy^i + 2, 

l 2 l 1+2’ L 2 O. 

The Omega envelope is defined as the region of combined 
conditions less than or equal to the Omega level of one and the 
Limit level or less of all the others for each of the conditions 
that are combined. For the two-condition case, the two regions 
bounded by 0,fi^, fi lc , L 2 and 0, L]_, &2C> n 2 are 0me S a envelopes. 
Although the combined Omega Condition is not included in 
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the Omega envelope, sufficient strength beyond the L ^+2 point is 
provided when designing for points and 2C * The line 

is used to approximate this effect. The Omega envelope, there- 
fore, is defined by the area bounded by the line segments 0^7 
Hi «ic» liic W 2C» ^2C fi 2’ and of the fi g ure * 1 ’ 



Figure 4. Limit and Omega Envelopes for Combined Conditions 


When the operational condition spectra cannot be de- 
fined in terms of their probabilities of exceedance, the Limit 
and Omega Conditions can be chosen according to engineering judge- 
ment. The only requirement is that the definition of the Limit 
and Omega Conditions be satisfied by the chosen values. That 
is, the Limit Condition should be the upper boundary of normal 
and expected operations, and the Omega Condition should be greater 
than the worst anticipated overload. A guide that could help 
in assigning Omega Conditions would be the malfunctions the 
structure is expected to survive. Condition levels that the 
malfunctions would produce might be considered as minimum values 
for Omega. 

2.2.3 Determine Limit and Omega Loads 

The Limit and Omega Conditions define the upper bounds 
of the condition for two separate requirements. The Limit or 
Omega Load is determined as the most critical external load ex- 
perienced in the condition up to and including the Limit or the 
Omega Condition. This investigation must be carried out with a 
particular component in mind. In linear systems, the Limit and 
Omega Loads are proportional to the magnitude of the Limit and 
Omega Conditions. However, nonlinearities might result from 
variations in aerodynamic forces, from the geometry of the struc- 
ture, or from thermal effects. For instance, loads in the 
diagonal members of a booster engine support structure vary with 
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the gimbal angle and peak when the thrust axis parallels the 
diagonal member. A typical variation might be as shown on 
Figure 5. In this example, choosing the load at the Limit Condi- 
tion of gimbal angle would not yield the most critical load. 

The peak load would occur at about 50 percent of the Limit Condi- 
tion. Hence, there is a need to investigate the entire spectrum 
of the conditions to see that the critical loads are found where 
nonlinearities might exist. In most cases, however, the Limit 
and Omega Conditions produce the critical loads. 



GIMBAL ANGLE 

Figure 5. Hypothetical Load in the Diagonal Members of the 
Tnrust Structure versus the Gimbal Angle 

The external loads are derived from the operating con- 
ditions in the standard manner employed by the loads analysts. 
This particular part of the design process is not a particular 
concern to the QSDC other than the fact that the possibility of 
an error in the loads analysis may affect the reliability in 
service. Usually, this possible error is disclosed by the flight 
loads survey program. See Appendix B for a discussion of the 
effect of this error on the reliability in service. 

The Limit and Omega Loads for the combined condition 
are defined as the highest loads that can be achieved within or 
on the Limit and Omega envelopes. Obviously, this is stretching 
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the one-dimensional definition to two or n dimensions. As in 
the single condition, a full analysis of the loads for the spec- 
trum of each condition combined with the other conditions would 
be required. This would yield the particular combinations of 
conditions that create critical external loads on the structure. 
The critical loads corresponding to the Limit envelope are known 
as the Limit Loads, and the critical loads corresponding to the 
Omega envelope are known as the Omega Loads. 

2.2.4 Compute Design Loads 

The Design Load for the Limit Condition and the Design 
Load for the Omega Condition are the loads to which the structure 
is sized. See Section 2.2.5. The Design Loads are the factored 
Limit and Omega Loads where the factor is the design and test 
factor of safety (TFS). Therefore, given the Limit and Omega Loads 
(Section 2.2.3), the Design Loads are determined by the TFS. 

The design and test factor of safety (TFS) is a con- 
tinuous function based on the following parameters: the scatter 
in structural strengths, the number of qualification tests, and 
the structural reliability desired. This factor of safety func- 
tion is a variable, as a result, in contrast with the fixed 
values of safety factors used in the Present System. Without 
going into the details of the TFS functions (a discussion can be 
found in Section 3;2), Figures 6 and 7 represent the design and 
test factor of safety for the Limit and Omega Loads, respectively. 
The characteristic of the Limit Design and Test Factor of Safety 
(LTFS) is that it is more dependent on the strength scatter co- 
efficient than the Omega Design and Test Factor of Safety (OTFS) . 
For low strength scatters and all reliability levels, the OTFS 
is equal to 1.0. However, as the scatter increases beyond 0.06 
it takes on values above 1.0 for the low risk design. For the 
standard risk design, the OTFS becomes greater than 1.0 when 
strength scatter coefficients of 0.12 are reached. The OTFS 
is a safety factor function performing the same type of role 
as the LTFS: that of insuring sufficient strength at the Omega 

Condition. 


The computation of the Design Loads could be shown 
by the following example. Consider the Space Shuttle booster as 
the structure being designed. Assuming that the structure dis- 
plays a scatter in strength of 12 percent (y s ~ 0.06), the LTFS 
and OTFS are 1.41 and 1.0, respectively, if the standard relia- 
bility goal is used. These factors are applied to the Limit 
and Omega Loads of the condition being considered. Choosing the 
condition of thrust for this example, the Limit and Omega Loads* 
can be found from Figure 3 to be 1.0 x 10^ pounds and 1.2 x 10 6 
pounds, respectively. Finally, the Design Loads are computed as 
the product of the loads and their corresponding factor of 
safety: 

* The condition and load for thrust are numerically the same. 
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Design Load for the 
Limit Condition 


Design Load for the 
Omega Condition 


Limit Load x LTFS 

1.0 x 10^ pounds x 1.41 
1.41 x 10^ pounds 
Omega Load x OTFS 

1.2 x 106 pounds x 1.0 
1.2 x 106 pounds 


co 



Figure 6. Limit Design and Test Factor of Safety 
(from Reference 1) 


At the preliminary level of design, the user should not be 
overly concerned with the value of the predicted strength scatter. 
Reference 1 documents the fact that relatively large differences 
between the predicted and actual strength scatter will result in 
relatively small differences in structural reliability. As a re- 
sult, the methods for estimating the strength scatter need not be 
extremely accurate, but they should assist the engineer in making 
a good approximation to the actual strength scatter. Methods for 
estimating the y s for the design are presented in Section 3.3, 
and some appropriate data is presented in Section 3.4. These 
methods should result in strength scatters close enough to the 
actual so that the LTFS and OTFS chosen will produce the level 
of reliability desired. When the methods for predicting the com- 
ponent strength scatter are used, the strength scatter applied to 
the design of the structure is the largest scatter of the several 
components. The reason for this is that the qualification test 
will not disclose an understrength of the component with the 
large scatter unless the Design Load for that component is applied 
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to it. Unfortunately, this Design Load usually cannot be applied 
to one element of the design without applying it to all of the 
elements. Thus, the component with the largest Ys becomes the 
controlling component in the choice of LTFS and OTFS and, hence, 
in the choice of the Design Load. 

To illustrate the application of this principle, one 
simplified example is presented. In the example there are two 
members representing the multi - element structure of the wing 
of a shuttle or similar vehicle. Maneuvering flight in the at- 
mosphere is the condition considered. A Limit Load Factor of 
3.0 is assumed. The two-member structure consists of a lower 
skin in tension and an upper spar cap in compression. The 
strength scatter for the skin is 0.04 and that for the spar cap 
is 0.06. Since the critical y s is 0.06, the LTFS is 1.41 (from 
Figure 6). The Design Load for the Limit Condition is the pro- 
duct of the Limit Load and the LTFS (3.0 x 1.41), namely 4.23, 
where the load and condition level are referred to as load 
factors . 


If the Omega Condition corresponds to a load factor of 
4.0 and the OTFS read from Figure 7 is 1.0, the Design Load for 
the Omega Condition is 1.0 x 4.0, or 4.0. It is a basic part of 
the QSDC methodology that the Limit and Omega Conditions and 
the corresponding Design Loads should be determined separately 
and carried through the analysis and test separately unless it 
is obvious that one or the other is the more critical. In this 
example, it is apparent that the Limit Design Load is the more 
critical . 



STRENGTH SCATTER (r s ) 


Figure 7. Omega Design and Test Factor of Safety (from 
Reference 1) 
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2 . 2.5 


Design Structure for Design Loads 


From this step forward the QSDC Procedure is essen- 
tially the same as that for the Present System. For all practical 
purposes, the designers, stress analysts, and test engineers will 
function as they always have. The structure is designed or sized 
at the component or element level by matching the material allow- 
able or component strength to the critical Design Load for the 
condition under consideration. In other words, the structure must 
be sized so that the margins of safety are positive, just as re- 
quired for designs in the Present System. 

If both the wing skin and spar cap of the previous exam- 
ple are designed with zero or positive margins, the strength dis- 
tributions of the components would be as shown on Figure 8. The 
LTFS of the wing spar cap would define the design and test load 
because of the larger strength scatter. Because the of the 
wing skin is less in the example, the "safe" load can be closer 
to the design and test load as shown in Figure 8. 



Figure 8. Design Load Defined by the Larger Strength Scatter 
of Several Components 
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In some structural systems it might be possible to test 
the skin separately to a lower load than that for the spar cap. 
Such tests must be made with caution. If separate tests and test 
articles are established, there is danger that the test articles 
may not be representative of the production vehicles because 
errors in the drawings and specifications of the production arti- 
cles may not be duplicated in the test article. Also, a test of 
anything less than the full-scale structure with all of its com- 
ponents may not disclose errors in the internal distribution of 
the external loads to the various subcomponents. 

2.2.6 Test Structure to Design Loads 

After the complete structure has been sized, as indi- 
cated in Section 2.2.5, the strength is verified by static test- 
ing the full scale structure to the Design Loads. This test 
discloses strength errors such as errors in the analytically de- 
rived internal load distributions, errors in the dimensions 
and call-outs on drawings, and in the fabrication, and just plain 
oversights in the analysis. It is assumed that there is "no 
error" in the external loads of the static test, because there 
is no way to verify them at the time. The verification of the 
external loads comes later from the results of a flight loads 
program. If the flight loads program results are found to be 
inconsistent (higher) than the strength tests requirements, the 
structure must be retested and, if necessary, redesigned to 
pass the new strength requirement that is derived from the higher 
flight loads data. A discussion of this part of the design 
cycle can be found in Appendix B. 

Besides disclosing errors, the static test provides 
an absolute, positive criterion by which it can be said that 
the strength requirements are met. Instead of trying to accom- 
plish the nearly impossible task of demonstrating a reliability 
such as 0.9999, the strength test represents a deterministic re- 
quirement that is adminis trable . The structure must survive in 
the static test to the design load without failure. Failure to 
survive the static test means that the structure is understrength 
and must be redesigned and retested. If the structure sustains 
the design load, the design is adequate. The design could, 
therefore, be put in the production phase. 

Alternatives to static testing the full-scale structure 
to the design load would include the following: 

1) High FS Design . A decision could be made not 
to static test at all, but to design to a 
higher factor of safety. This is common in 
civil engineering in bridge design where the 
articles are one of a kind. The bridge struc- 
tures are designed to a requirement approxi- 
mating a factor of safety of 4. Similarly, 
there has been thought expressed in the aero- 
space industry that a factor of safety of 
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about 3 should be applied to non-tested 
aerospace structures. Applying the com- 
puter program of Reference 1 to the situ- 
ation of no static test and a design factor 
of safety of 3.0, the computer reliability 
is a little less than 0.999 (about 0.9986) 
for most values of strength scatter. How- 
ever, a factor of safety of 7.6 would be 
necessary to obtain the probability of 
failure of 0.000001 at Limit that is con- 
sistent with the "standard" reliability 
goal of 0.9999. Thus, depending on the 
reliability desired for the particular de- 
sign, the decision not to static test could 
greatly affect the design. The advantages 
of not statically testing the structure are 
that the costs associated with static testing 
are eliminated and there are no schedule de- 
lays that would occur if the structure were 
tested and failed. The disadvantage of not 
static testing the full-scale structure is 
that there is no way to disclose the possi- 
ble errors in strength. If the structure 
is understrength, the cost of redesign and 
retrofitting the service vehicle (after a 
costly operational failure) would greatly 
outweigh the cost of testing and disclosing 
the understrength design. The use of large 
factors of safety, however, does not exclude 
the possibility of grossly understrength de- 
signs. For example, a decimal point error 
could result in a design which is one-tenth 
of its intended strength. There is no guar- 
antee against such an eventuality and if it 
did occur even the 7.6 factor of safety 
mentioned above would be insufficient. 

2) Proof Testing . By proof testing the structure 
up to the Limit Load levels, the structural 
adequacy of an individual structure for op- 
erations up to the Limit Condition can be 
demonstrated. This test will reject struc- 
tures that are so grossly understrength that 
they would fail below Limit. The advantages 
of proof testing is that it can disclose 
fabrication and maintenance errors. The dis- 
advantages of this type of testing are that 
design errors are not detected and the reli- 
ability of the structure is not demonstrated. 
Furthermore, no capability in strength beyond 
the Limit Load is guaranteed. Reference 1 
shows that failures due to overloads beyond 
the Limit Condition are more likely than 
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understrength failures below the Limit 
Condition. The proof tests alone without 
a design qualification test is generally 
insufficient to establish a high level 
of structural reliability. 

3) Coupon Testing . This form of testing has 
been used to produce statistical data 
quickly and inexpensively for materials 
and environments that would be appropri- 
ate for the structure. Unfortunately, 
this testing method does not disclose 
errors that can occur in the actual full- 
scale structure. 

4) Component Testing . This form of testing 
can disclose many of the same type of de- 
sign errors that a full-scale static test 
can disclose. However, the component test 
will not reveal problem areas due to un- 
expected interactions between components 
changing the internal load distribution. 
Furthermore, component tests may not dis- 
close assembly errors such as misaligned 
load paths. Another reason that component 
tests cannot assure the same degree of re- 
liability as a full-scale test is that the 
component test article is likely to be fab- 
ricated from a different set of drawings 
than those used for the production vehicles. 
This introduces the possibility of a dis- 
crepancy between the two. Such errors 
could invalidate the component test. 

5) Reduced Scale Model . The reduced scale 
model test has several drawbacks that ex- 
clude it from strong consideration. First, 
as a qualification test, the duplication of 
full-scale workmanship such as tolerances 
and variations in standard materials cannot 
be duplicated sufficiently. Second, errors 
may occur in either the model or full-scale 
drawings that could make the reduced- scale 
static strength test misleading. 

6) Multiple Full-Scale Tests . This method lies 

at the other extreme from the no-test approach. 
Here, the advantages are more certainty of 
error disclosure and lower design factors of 
safety. These advantages are offset by the 
increased cost of testing and greater like- 
lihood of schedule delays. The unique ad- 
vantage of the QSDC Procedure is that the 
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advantages can be quantified and used to 
make tradeoffs against the cost increases 
and schedule delays that are possible. 

2.2.7 Monitor Lifetime Operational History 

The purpose of monitoring the lifetime operational 
history is to validate the choice of Limit and Omega Condi- 
tions. Also, the loads associated with the Limit and Omega 
Conditions can be validated through a Flight Loads Program. 

The Limit Loads may be measured directly, since the flight 
test article can be operated up to the Limit Conditions and 
readings of the loads can be taken from it. 

Determination of the Omega load and verification of 
the choice of the Omega Condition will depend on the extrapola- 
tion of the available data. For example, the load spectrum de- 
veloped in Section 2.2.1 may predict that 80 percent of Limit is 
exceeded 200 times during a lifetime of 5000 hours (per Figure 
9). After 500 hours, or one- tenth of the vehicle lifetime, the 
80 percent Limit value should be exceeded by only ten percent of 
the total number of exceedances or 20 times on the average. Par- 
ticular vehicles may only exceed it 14 or 15 times while others 
may have exceeded it 25 or 26 times by the end of 500 hours. 
Nevertheless, the overall average should be 20. 



PERCENT LIMIT LOAD 


Figure 9. Number of Exceedances of Limit Load per Lifetime 
of the Average Vehicle (5000 hours) 
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Generally, if the frequency of occurrence of the con- 
ditions below the maximum operational value experienced are less 
than the predicted values, then the actual Omega Condition is 
likely to be less than that predicted. This would mean that the 
Omega Condition used in the design was actually more severe than 
necessary and that the structure was conservatively designed. 

If on the other hand, the data on condition magni- 
tudes below the maximum operational value experienced are re- 
corded more frequently than the predicted value, say 60 ex- 
ceedances in 500 hours, instead of the 20' predicted, it can 
be presumed that the entire spectrum is greater and that the 
Omega Condition will occur more frequently than predicted. 
Finally, the decision can be reached that the choice of the 
Omega Condition was insufficient and that the structure was 
not conservatively designed. 

If the flight loads monitoring of aerospace vehicles 
were continued throughout the vehicles lifetime, warning systems, 
like the one developed in Reference 30, could be used. In brief, 
the warning system can be based on the number of exceedances of 
a given condition as in Figure 10. In order to accumulate enough 
exceedances for a statistically significant value, the given 
condition should be some percentage of the Limit, say 80 percent. 
This figure can be adjusted upwards as the number of hours of 
flight time increases. For instance, above 2000 hours, the 
given condition could be 90 percent Limit; and above 4000 hours, 
the given condition could be 95 percent Limit. 



Figure 10. Warning System Mechanism for Operations Monitoring 
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The warning system, as part of a computerized moni- 
toring system, prints out warning statements for excessive ex- 
ceedances and excessive exceedance rates of the given condition. 
Whenever the number of exceedances crosses the warning line (for 
a specific number of flight hours) , the warning system is trig- 
gered. Whenever the number of exceedances cross the re-set line 
in the positive direction, the program sets this exceedance as 
the first exceedance at the beginning of a coarser increment of 
flight hours. The purpose of the re-set function is to detect 
high exceedance rates after a long period of satisfactory service. 
Higher exceedance rates might be due to a change in the use. of 
the vehicle, i.e., new mission requirements. 

2.2.8 Redesign, and Retrofit 

The last step in the QSDC Procedure is the same as in 
the Present System. If a failure occurs at anytime during the 
service life of the vehicle, a decision must be made as to the 
cause of the failure and the required corrective action. If it 
is determined that the usage has been more severe than predicted 
so that the structure is overloaded, the problem can be solved by 
reducing the severity of the operational usage. If this action 
is not feasible, new Limit and Omega Conditions must be defined 
and the design process recycled. If the decision is made that 
the usage and loads are consistent with predicted values, the 
understrength must be corrected and appropriate retrofits developed 
and installed. 

2.3 Time-Dependent (Fatigue) Situations 
2.3.1 Intent 


The intent of the QSDC Procedure as described in 
Section 2.1 is defined largely in terms of static or time-inde- 
pendent strength situations. At the end of Section 2.1.2, time- 
dependent strength situations are discussed briefly. It is 
noted that "the intent of the QSDC Procedure is the same in the 
fatigue situation as in the static situation." Specifically, 
the structural system should be "safe" for all operations up to 
the Limit Conditions and "most" of the structural systems should 
have overload capability to survive operations beyond the Limit 
Conditions up to the designated Omega Condition. It should be 
kept firmly in mind that no structure ever fails in fatigue be- 
cause a certain number of load cycles have been imposed on the 
system or because a certain number of flight hours have elapsed. 

A failure occurs when the structural resistance to load (i.e., 
strength) at a given moment is less than the load at that moment. 
Fatigue life, as it is ordinarily defined, has nothing directly 
to do with the mechanistic aspects of structural failure. 

The situation is illustrated in Figure 11. Two typical 
time -dependent residual strength distributions versus time are 
shown. What might be considered the distribution for a "good" 


32 



design is described by curves A and B. A "bad" design is des- 
cribed by curves C and D. If the various individual vehicles in 
a fleet could be removed from service and static tested, the 
curves A and B might represent an envelope of the residual 
strengths so determined. If the operational loading environ- 
ment is simulated in test by the truncated load spectrum that 
is used in most fatigue tests, the test article will eventually 
fail at the maximum load in the truncated spectrum or at some 
lesser load. Since the number of occurrences increases rapidly 
as the load goes down, the minimum load at failure is not likely 
to be much lower than the maximum. Thus, the range of possible 
loads at test failure is rather small as shown on Figure 11. 

The time difference between the minimum and maximum test life prob- 
ably is larger than shown on Figure 11. This cannot be proved 
at this time since there is a lack of data to define the true 
scatter in life for typical structural assemblies. However, it 
appears that the maximum life is usually at least two to four 
times the minimum life rather than the 1.5 ratio shown. 



The residual strength distribution of the "good" design 
on Figure 11 portrays a situation that is likely to be marginally 
acceptable. If the lower boundary (99 -percent-exceed) begins to 
move down from the Omega Load Level, the failure, rate begins to 
increase. If the structure should be designed and tested to 
Omega Load in order to attain the desired static structural relia- 
bility, any decrease in residual strength below the Omega Load 
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will result in less than the desired reliability. With a small 
strength degradation at the end of the service life, the change 
in failure rate and numbers of failures would not be obvious. 

All of the additional failures would occur in the region desig- 
nated as "Probable Service Failures." These failures would be 
the result of the small fraction of the fleet vehicles which 
experience a gross penetration of the Limit Condition. The total 
number of failures would not be much above the tolerable level, 
but the rate of failure (number of failures per hour or 100 
hours) would be significantly higher. It is stated in Reference 
1 (Volume III, page 87) that a 10 percent degradation in re- 
sidual strength at the end of service life would result in an 
increase in failure rate by a factor of 10,000. Since the choice 
of the Omega Condition and its relation to the static strength 
represents the minimum acceptable for the desired level of struc- 
tural reliability, it can be understood why the degradation 
shown on Figure 11 is considered to be marginally acceptable. 

This concept of a marginally acceptable time-dependent 
strength distribution does not seem to be consistent with the 
picture of the fatigue failure problem as envisioned by most 
engineers. The conventional concept of a fatigue problem is a 
sudden failure at a relatively low load, typically at or below 
the Limit Load. The "bad" design, described by curves C and D 
of Figure 11, is more representative of this definition of what 
happens when there is a fatigue failure problem. In this group 
of vehicles from the "bad” design, the strength of an individual 
vehicle would drop so fast that the probability of experiencing 
a load between Limit and Omega. during the short time period 
of the strength drop would be quite small. The probability 
of experiencing extreme overloads during a full lifetime is 
rather small and the probability during a small fraction of 
a lifetime becomes vanishingly small. As a result, the fatigue 
failure for a "bad" design is most likely to occur at a load 
considerably below Limit. This, presumably, is the basis for 
the usual concept of when and at what load fatigue failures occur. 

The location of test failure is likely to be within 
the region of probable service failures as shown on Figure 11. 

The region of test failure should be somewhat smaller than the 
region of service failures. It would be extremely difficult 
to detect any difference' in the mode and time of test failure 
and the mode and time of service failure. This result reinforces 
the concept of fatigue failure occurring at relatively low loads 
and at about the same number of cycles in service as in test. 

This is the same concept of fatigue life that has been associated 
with constant-amplitude testing since the beginning of engineering 
studies of the fatigue problem. 

The problem with conventional fatigue analysis and 
testing of the life in a random load environment is that it does 
not recognize that structural failures may occur in the region 
above Limit Load due to a time-dependent loss of Residual Strength. 
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The closer the design comes to being a "good” design the more 
likely the failures are to be in the high region associated with 
the distribution AB rather than the low region associated with 
distribution CD. Another part of the problem is that errors 
in fatigue analysis may occur as frequently or more frequently 
than they occur in static analysis. The Jablecki data discussed 
in Section 2.1.2 and the added discussion in Appendix B show 
the frequency of analytical error in static design. Figure 
2 and the associated discussion point out how the appropriate 
static test can reject the under-designed systems with a high 
degree of certainty. The fatigue test must perform the same 
function as the static test as shown on Figure 2. The fatigue 
test must reject any unsatisfactory design with a high degree 
of certainty. 

It is the intent of the QSDC Procedure to develop 
methodology which will lead to an analytical solution recog- 
nizing the interaction between a random load spectrum with 
occasional overloads in a fleet of vehicles and the distribu- 
tion of residual strength during the service life of those 
vehicles. Even more important, the QSDC Procedure extends the 
concept of error disclosure from the static to the fatigue sit- 
uation. The test requirement is intended to establish test 
conditions that will reject all designs which do not meet the 
QSDC standards for a minimal loss in Residual Strength during 
the service lifetime. 

2.3.2 Implementation of Intent 

The implementation of the intent of the QSDC Procedure 
in time -dependent (Fatigue) situations starts from the same base 
as in the static design situation. If the intent of the QSDC 
Procedure is implemented properly, the resulting structural 
system will satisfactorily perform its function as a vehicle 
subsystem. The structure will be "safe" and "never" fail in 
the operational region up to the Limit Condition, and "most" of 
the structures will survive penetration into the overload region 
between the Limit and Omega 'Conditions. 

In the context of the fatigue situation, the Limit 
Condition is represented by a Limit spectrum, a static Limit 
Condition (load factor or other parameter) , and a Limit Service 
Life. The Limit Spectrum is a load spectrum whose probability 
of exceedance is no greater than the probability of exceeding 
the Limit Condition shown on Table III. The Limit Condition 
has the same value as defined in Section 2.2.2. The Limit Service 
Life is defined as the number of hours (or flights) that are 
expected before operations are terminated. Since each of these 
factors is normal and expected and permissible, any vehicle 
operated within bounds of these parameters should be "safe" 
and "never" fail. 

To complete the implementation, Omega values must 
be established for the same three functions as for the Limit 
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Condition. The Omega load factor, velocity, or other single 
parameter is already defined in Section 2.2.2. The Omega 
Spectrum is like the Limit Spectrum but more severe with a 
probability of exceedance no greater than the probability of 
exceeding the Omega Condition shown on Table III. The Omega 
Service Life is the maximum life to which any vehicle would 
ever be operated. "Most" of the vehicles should survive oper- 
ations to any one of the three Omega parameters provided the 
other two do not exceed Limit. This is analagous to the static 
situation discussed in Section 2.2.2 and illustrated by Figure 
4. Satisfaction of the Limit and Omega requirements in the 
fatigue situation is not as straightforward as in the static 
situation as discussed in Section 2.2. The principal obstacle 
is that analytical techniques for predicting the lifetime distri- 
bution of Residual Strength are not well developed. However, 
it should be recognized that present methodology, utilizing 
Miner's Fraction to predict life and validating that prediction 
by testing to a multiple of the specified service life using 
a truncated load spectrum, does not solve the problem directly, 
either. What success has been achieved with the present approach 
has been due to the indirect relation between the life distri- 
bution of test failures and the probable distribution of service 
failures as shown on Figure 11. Only when the resulting strength 
approximates curve AB on Figure 11 will the design be considered 
as being "good." Since the residual strength is not determined 
or even calculated directly, there is no guarantee that a 2X or 
4X "life" will result in the required high level of strength 
during the specified service life. The high incidence of fatigue 
failures in aircraft operations in recent years does not foster 
great confidence that the desired results are being achieved 
by present methods. It is suggested that the hardware contractor 
for the space shuttle be required to define how he plans to 
develop a satisfactory lifetime Residual Strength for the shut- 
tle or other space vehicles. 

In Reference 1 (Volume II, Section 2.4) one approach 
to the direct solution of the fatigue reliability problem is pre- 
sented. An assumption is made that the relationship between 
hours in service life and residual strength is defined by the 
relationship 

Ultimate Strength 
°® e Residual Strength 

where T is the number of operational hours and K is a constant 
dependent on the structural configuration and loading history. 
This relationship permits the calculation of the structural re- 
liability resulting from designing and testing to various multi- 
ples of the specified service life. Figure 12 shows the life 
multiple required as a function of the number of tests. The 
procedure is very analagous to that described for the static 
situation in Sections 2.2.4 and 2.2.6. In both the static and 
fatigue cases, passing the prescribed test insures that "bad" 
designs will be rejected with a high degree of certainty. The 
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"good" designs that pass the test will have a high strength 
initially as shown on Figure 2 and will retain that strength 
during the service lifetime as shown on Figure 11. 



SERVICE LIFETIMES 

Figure 12. Structural Reliability of the Design for Various 
Numbers of Fatigue Tests and Multiples of the 
Service Lifetime (from Reference 1) 

Because the QSDC procedure is strength-oriented, the 
fatigue test procedure can be modified by conducting a- static 
test to the same design load required in Section 2.2.6. As 
shown on Figure 13, this alternate test requirement may shorten 
the fatigue testing time at the expense of conducting an addi- 
tional static test. 

It should be noted that the curves of Figures 12 and 
13 are based on the "standard" vehicle with a structural relia- 
bility goal of 0.9999 as identified on Table III. If another 
reliability goal is chosen, the curves on Figures 12 and 13 must 
be recalculated by the method of Reference 1 (Volume III, 

Section III). 
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SERVICE LIFETIMES 

Figure 13. Structural Reliability of the Design for a Fatigue Test 
to the End of the Service Life Followed by a Static 
Test (from Reference 1). 


It is believed that the requirements defined by 
Figures 12 and 13 are reasonable and justifiable. However, it 
should be kept in mind that there are two major assumptions 
involved in formulating the curves of Figures 12 and 13. The 
first is that the scatter in life (defined as the ratio of the 
2a or maximum life to the mean life) is assumed to be 4 to 1. 
This appears to be realistic and slightly conservative on the 
basis of the limited amount of test data available at present. 
In the same manner that the LTFS and OTFS factors for static 
strength (Figures 6 and 7) vary with strength scatter, the 
life multiple defined for the fatigue design and test require- 
ments will vary. Figures 12 and 13 may be modified for shuttle 
design if substantiating data on the life scatter is available. 
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The other major assumption is that the shape of the 
Residual Strength curve is defined by 

Ultimate Strength 
KT - log e Residual Strength 

This definition of the basic shape of the Residual Strength 
function appears to be reasonable for correlating the transition 
from initial strength to the strength at failure at the end of 
the typical fatigue test. It is known that in some situations 
the strength degradation is delayed as a result of the time re- 
quired for crack nucleation. In such cases the Residual Strength 
curve approaches a rectangular shape with a precipitous drop 
in strength preceding the final rupture of the material. If 
such is the case, the logarithmic decrement in strength assumed 
in the formulation of Figures 12 and 13 will be conservative. 

It is strongly recommended that any approach to the 
time-dependent strength problem that is less conservative than 
that recommended in this section of the QSDC Procedure be 
examined carefully and judiciously. In any event, the approach 
should consider (1) the possibility of failure during the ser- 
vice life at loads beyond Limit but less than the design load, 

(2) the possibility that the analytical determination of life 
is incorrect, and (3) the possibility of -qualifying a design 
with inadequate life as the result of the random success of 
the test article to an unusually long fatigue life. 
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3. 


STRENGTH SCATTER COEFFICIENT 


3.1 Definition 


The strength scatter of a structural system, defined as the 
coefficient of strength variation (Ys) > is an important param- 
eter in the QSDC Procedure. y s represents the dispersion about 
the mean of the strength at failure of a group of nominally 
identical structures. Mathematically, y s is the standard devia- 
tion (a) expressed in nondimensional terms. The coefficient of 
variation is equal to the standard deviation divided by the mean 
strength (p) of the group of nominally identical structures, i.e., 


3 . 2 Importance of the Strength Scatter to the Design Process 

Consideration of the scatter in strength of nominally iden- 
tical structures is important because of the effect variations 
in the scatter have on the calculated reliability of the fleet 
of structures. If the reliability is computed from the proba- 
bility of failure, the effect of the variation of the scatter 
can be shown by the increased probability of failure for the 
following three examples which are consistent except for the 
respective strength scatter coefficients of 0.00, 0.05, and 0.15. 
The choices of Limit and Omega Conditions at 100 and 150 percent 
are intended to be comparable to the design values of the Present 
System. 

The three examples will illustrate that the reliability 
of a design (represented by a group of nominally identical struc- 
tures) will decrease as the scatter in the strength of the 
structures increases. If the scatter is not considered as in 
the Present System, the actual reliability of the structure 
is not known. All three examples consider a structure designed 
by the Present System, that is, with a 1.5 factor of safety. 

The basis of the design is a non-dimensional design load of 
100 percent. (This is referred to as the Limit Load in both 
the Present System and the QSDC Procedure) . For the Present 
System, the Ultimate Load would equal 150 percent. The figure 
derived for the reliability of the structure is not based on 
the results of the computer program, but is the result of the 
following approximate analysis. 

The reliability of the design computed by the program 
can be reasonably approximated by using a single strength dis- 
tribution instead of the summation of strength distributions 
used in the program. When the strength distribution lies midway 
between the design load and the ultimate load, the reliability 
calculated closely approximates the reliability calculated 
by the program. The reliability is calculated by multiplying 
the probability of having passed the static test to the ultimate 
load by the probability of having a structure with a strength 
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equal to the Limit Load. Finally, this combined probability 
is multiplied by the probability of exceeding the Limit Load, 
thus producing the probability of failure. The reliability 
is then the complement of the probability of failure. Performing 
this quick analysis on the three examples yields the following: 

Example 1 y s = 0.00 


In this example, as in the other two, 'the load distri- 
bution is assumed to be rectangular. The probability of equal- 
ing any level of load up to and including the Limit Load is 
one. For all values of load above the Limit, the probability 
of exceedance is zero. The Limit Load, as previously stated, 
is at 100 percent, and the ultimate load is at 150 percent. 
Despite the designer's attempt to place the strength distribution 
above the 150 percent level by matching the material allowable 
with the ultimate load (Present System design philosophy) , the 
actual strength distribution of the design is located at 125 
percent. Since there is no scatter in the strength of the design 
(y s = 0), the strength of each structure is at 125 percent. 

The probability of passing the test to 150 percent is zero. The 
probability of having a strength at the Limit level is also zero. 
The probability of exceeding the Limit Load is zero. The product 
of these three probabilities (the probability of failure) is 
zero. Therefore, the structure is 100 percent reliable. The 
test structure will fail the static test to 150 percent and, 
therefore, must be redesigned to pass a second static test. 

The final result will be that all of the strengths will be 
above 150 percent and all of the loads will be below 100 percent. 
The structure will still retain its absolute reliability with 
the added cost of the increased strength. 


Example 2 y s = 0.05 


The load distribution is the same as in Example 1. The 
location of the mean strength is again at 125 percent. The 
strength distribution defined by the y s of 0.05 is concentrated 
about the 125 percent level, with only the tails of the distri- 
bution crossing the 100 percent and 150 percent levels. The 
ultimate load is 25 percent above the mean, and the design 
load is 25 percent below the mean. Given that the mean strength 
is at 125 percent, the size of the standard deviation (a) can 
be computed from the definition of the strength scatter (y s ) : 

Y s = o/v 
a = y y 

= 0.05 (125) 

= 6.25 

The number of standard deviations, used as an indication 
of the probability of occurrence, is found by dividing the 
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difference (A) between the mean and the intended value (here 
150 percent) by the size of the standard deviation: 

n = A 
a 

= 25 
6.25 

= 4. 

This value for the standard deviation corresponds to a 
probability of occurrence of 3.17 x 10*5. Thus, a successful 
strength test to 150 percent would occur once in 31,700 tests. 
Similarly, the occurrence of a strength equal to the Limit 
level is one in 31,700. The probability of this combination is 
about 10 x 10*10. The probability of failure of this design 
would therefore be 1 x 10*9 (the probability of exceedance of 
the Limit load is one.) The corresponding reliability of the 
design would be the complement of this probability of failure 
or 0.999999999. The significance of this result is that the 
chance of an operational failure at a Limit Condition after a 
test article passes a test to 150 percent of Limit is about one 
in one billion. This possibility is so near zero that any 
structural system can be considered "safe" in operation up 
to Limit after the design is qualified by a successful test 
to 150 percent of Limit. 

Thus, a "safe" structural system results from compliance 
with the deterministic requirements of the Present System ap- 
parently without any . probabilistic considerations. However, 
this desired result is dependent on the strength scatter being 
relatively low. In the next example it is shown that the same 
procedure will not result in safe structure when the scatter 
is large. 


Example 3 y s = 0.15 


As in Examples 1 and 2, the mean strength is at 125 percent and 
the load distribution is the same. The standard deviation (a) 
in this example is: 


a 


Y S P 

.15 (125) 
18.75 


The number of standard deviations (n) is: 


a 

25 

18.75 
= 1.33 
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The probability of passing the static test to the ultimate 
load is 0.0918. Similarly, the probability of having a strength 
at the Limit Level is 0.0918. Since the probability of exceed- 
ing the Limit Load is one, the probability of failure is 0.00843. 
The corresponding reliability is therefore 0.9916. The reduc- 
tion in reliability with this variation in strength is very 
large: from 0.999999999 to about 0.99. 

It is very dubious that the vehicle user would consider 
the vehicle to be "safe" if the chance of catastrophic failure 
at Limit were one in one hundred. This change from safe to un- 
safe structure has not been a serious problem in the past because 
structural systems with large strength scatters were avoided by 
empirical means. Such things as brittle materials, long slender 
columns, very hot structure, and welds in tension were banned. 

In recent years every one of the ground rules resulting in narrow- 
scatter structural systems has been abandoned in the quest for 
higher performance in structural systems. As a result, large- 
scatter structural systems are no longer uncommon. 

The QSDC Procedure considers this effect of the strength 
scatter. It places the choice of design factors on the basis 
of a desired structural reliability goal and the scatter in 
strength of the design. In this manner, a consistent level 
of reliability is maintained. 

3 . 3 Estimation of the Strength Scatter 

Having defined the strength scatter and its role in the 
QSDC design Procedure, the estimation of values of strength 
scatter to be used in the design of a structure is now dis- 
cussed. The strength scatter must be estimated so that design 
factors can be assigned to the structure and structural com- 
ponents. As discussed in Section 2.2.4, the strength scatter 
of the component with the highest strength scatter is used 
to define the design factors. The methods of this section are 
expected to produce values of strength scatter that will esti- 
mate the actual strength scatter of the component considered 
with a satisfactory degree of accuracy. 

It should be noted at the outset that there is, generally, 
insufficient data on which to base a purely statistical estima- 
tion of the strength scatter of any given component. The major 
amount of data with statistically significant sample sizes 
can be found only among material property tests. Most of the 
data dealing with component strength scatters have barely enough 
samples to permit considering the resulting scatter values sta- 
tistically. This deficiency points to a need for more test data, 
but more importantly it negates any present need for a highly 
analytic estimation method. As more data becomes available, 
more refined estimating techniques will be generated. For 
the present, however, the following methods for estimating the 
strength scatter of a components are presented: a range estima- 
tion, a baseline estimation, an estimation by class, an estimation 
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by judgement, and a preliminary analytic technique. 

Whichever form is chosen to make an estimation of the 
strength scatter of the component and, hence, of the structure, 
the resulting quantity can be used with confidence. The esti- 
mation of the strength scatter, when made with reasonable 
engineering judgement, will either be close to the actual value 
of the scatter or be conservative enough when used in the QSDC 
Procedure to maintain the desired level of reliability. The 
reliability of the structure is not greatly sensitive to mod- 
erate variations in the estimation of the component strength 
scatter. That is, if 0.0425 is specified instead of the actual 
0.0400, the reliability might only increase from say 0.9999 to 
0.99994. Even with an estimate as low as 0.04 for an actual 
scatter (y s ) of 0.05, the reliability figure is reduced from 
0.9999 to about 0.9994. Thus, estimates of the strength scatter 
of the components and, hence, the strength scatter of the struc- 
tural system can be made with enough confidence to permit using 
the estimates as the basis for setting preliminary design factors. 

3.3.1 Range Estimation 

This method of estimating the strength scatter of a 
component is based on the range in available test data. Essen- 
tially the observed range is equated with the expected range 
for the given sample size. The expected range for a given 
sample size is listed in the following table. The range is 
defined by the number (n) of standard deviations (a) . 


Sample Size n 


5-10 3 

10-100 4 

100-1000 5 

1000-10000 6 

10000-100000 8 


The observed range is merely the difference between 
the highest strength and the lowest strength in the test data 
(HI-LO). 


The strength scatter, defined as the size of the stan- 
dard deviation (a) , would then be the range divided by the number 
of standard deviations it defines, i.e., 

(HI-LO) 

a = - 

n 

The other parameter needed to define the strength 
scatter is the mean strength (y) which is approximated by the 
arithmetic average of the highest and lowest observed strengths, 

1,e * ’ u = (HI +L0) 

2 
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Finally the strength scatter (y s ) is estimated by 
dividing the standard deviation (a) by the mean (y) , i.e., 

(HI - LO) , (HI +L0) 
n 2 

2 (HI -LO) 
n (HI+LO) 

where n is determined from the table by the sample size (the 
number of test articles). 

3.3.2 Baseline Estimation 



As a second method for estimating the strength scatter 
of structural components, deviations from a standard baseline 
strength scatter are considered. The baseline strength scatter 
is based on the ±10 percent variation about the mean value expected 
in normal engineering work. This nominal variation is equiva- 
lent to a y s of 0.05. Deviations (A) are considered from this 
baseline by the simple rule of: 

y s = 0.05 ± A 

where the deviations (A) are based on the following considera- 
tions concerning the strength scatter of the component. The 
material used should be the first consideration: ductile materials 

may allow negative deviations (Ys less than 0.05), whereas brittle 
materials would require positive deviations (y s above 0.05). 

Notch sensitivity could be an important parameter here. As a 
second consideration, material processes may need investigation. 
Standard, well-controlled techniques such as rolling and extru- 
sions would produce negative deviations (low Y s )> and less pre- 
cise methods, such as castings, will produce positive deviations 
(high Ys) • A third consideration, structural elements, such 
as honeycomb and waffle, will result in positive deviations 
(high y s ) , whereas fasteners and rivets display a negative devia- 
tion (low Y s )- Finally, fabrication techniques may need consid- 
eration. Standard joint and close tolerances exhibit negative 
deviations (low Ys ) t whereas welds, bonding, and large tolerances 
do not (y s high) . 

3.3.3 Estimation by Class 

A third method of estimating the strength scatter was 
suggested by the author in a study contract for NASA (Reference 7) . 
This method consists of dividing structures into four classes as in 
Table IV. A range of Ys is proposed for each class, and a typical 
structural form is indicated. If the designer chooses the maximum 
strength scatter in any given class for a particular design, the 
design will be conservative. If the designer wishes to decrease 
the Ys helow the maximum for the particular design group, justi- 
fication of the choice of y s should be made. 
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TABLE IV. STRENGTH SCATTER VALUES BASED ON STRUCTURAL CLASSES 


Class 


Description 


A These structures are of high-quality, conven- 

tional construction for which, from years of 
experience, small variation in strength can 
be expected. This class will include conven- 
tional structure with high ductility materials, 
riveted or bolted construction at moderate 
temperatures, etc. The upper limit of y s for 
this class is arbitrarily set at 0.04. 

B These structures include those for which a 

slightly higher y s ma Y be expected than for 
Class A structures. In this class will 
fall high-quality welded and bonded structures 
and those that fail in a simple buckling 
mode. The upper limit of y s for this class 
is arbitrarily set at 0.09. 

C These structures have a larger variation in 

strength than those in Classes A and B, but 
are of a quality which may be used occasionally 
in primary structure. Most high-quality cast- 
ing and structures that fail in buckling prob- 
ably fall in this category. The upper limit 
of y s for this class is arbitrarily set at 0.125. 

D All structures having y s > 0.125 are considered 

to fall in Class D. Most brittle structures 
and shells that buckle catastrophically under 
external pressure probably would be classified 
as Class D. 


A factor that may justify the choice of a lower y s may 
be the use of enough static tests for a statistical value of 
strength scatter. 

3.3.4 Judgement Estimation 

Another form of estimating the strength scatter could be 
derived from the preliminary estimates of Figure 14. Shown here 
are values of Ys that are expected to be reasonable for preliminary 
design work and are based on engineering judgement. The esti- 
mates are made at three different levels: materials, structural 

elements, and built-up structure. The strength scatters of the 
built-up structure can be used as they are or they can be adjusted 
to reflect the knowledge of the designer on the particular 
configuration being considered. Although the strength scat- 
ter for structural elements may stand by itself, it should 
be combined with other appropriate factors by the methods 
discussed in Section 3.3.5. The material y s should not repre- 
sent the structure; rather it must be combined with other ap- 
propriate factors to produce a component y s . 
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materials 


ALUMINUM 
STEEL 

CARBON 
ALLOY 
STAINLESS 
SUPERALLOY 
TITANIUM 
REFRACTORY 
COMPOSITES 
CERAMICS 
STRUCTURAL ELEMENTS 

CASTINGS (SAND) 

CASTINGS (CENTRIFUGAL) 

EXTRUStONS 
FORGINGS 
COLUMNS 
FITTINGS 
HONEYCOMB 
WELDS IN TENSION 
BUILT-UP STRUCTURES 

AEROSPACE COMPONENTS 
PRESSURE VESSELS 
LARGE THIN SHELL CYLINDERS 

0 .04 .08 .12 .16 .20 .24 .28 .32 .36 

STRENGTH SCATTER COEFFICIENT (Y*) 

Figure 14. Typical Values of the Strength Scatter 
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3.3.5 Preliminary Analytical Technique 

The strength scatter of structural components may also 
be derived by analytically combining several factors. That is, 
the component strength scatter can be synthesized from the con- 
sideration of the individual factors that contribute to it. Such 
factors might be the variation in material properties (y S m) » 
the variation in dimensions (Ysn) » an d the variation in the con- 
figuration and fabrication of the component (Ysp) • 
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The combinatory rule for the component strength scatter 
is the square root of the sum of the squares; i.e., 

^sc' + W * 'tsf* 

for normally distributed variables. 

The combination of two strength scatter factors, the 
basic material strength scatter (y s ) and the configuration and 
fabrication strength scatter (Ysp) > is shown graphically in 
Figure 15. Several points can be quickly illustrated. First, 
the gray region represents the ordinary values expected for the 
component strength scatter. The region centers on a y s of 0.05. 
Second, the dominance of one strength scatter factor greatly 
in excess of the other strength scatter factors is readily ap- 
parent. At point B, the configuration and fabrication strength 
scatter is greatly in excess of the basic material strength 
scatter, being equal to 0.20 and 0.04, respectively. By the 
general rule, component strength scatter (Ysc) i s: 

Ys C = A'sm* + Tsp 2 

= ✓'(0.04) 2 + (0 . 20) 2 
= 0.204 

Thus, the component strength scatter is just about equal to the 
configuration and fabrication strength scatter. In such obvious 
cases , the configuration and fabrication strength scatter can be 
used as the component strength scatter without need for the anal- 
ytic estimation. Point C also illustrates the dominance of the 
single strength scatter factor. In this case, the material 
strength scatter is dominant. The values of material strength 
scatter and the configuration and fabrication strength scatter 
are 0.20 and 0.02, respectively. The component strength scatter 
is : 

Y sc = Asf 2 + Tsm* 

= /( 0.02 ) z + (0 . 20) 2 

= 0.201 

Thus, the component strength scatter is again essentially equal 
to the dominating strength scatter factor. 

At the present, the values of strength scatter for 
the factors of materials, dimensions, and configurations have 
not been developed. This is due to the lack of sufficient 
data on which to base a statistical analysis which could gen- 
erate the strength scatter values needed for this type of anal- 
ysis. In the meantime, however, engineering judgement can be 
relied on to arrive at strength scatter values to be used in 
the estimation. 
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Basic Material Strength Scatter (Ys m ) 

Figure 15. The Combination 'of Strength Scatter Factors 


3.4 Test Data 

The following tables represent the results of the litera- 
ture search for strength scatter data. Unfortunately, there was 
very little data on the strength scatter of structures avail- 
able; and structural components, generally, had insufficient data 
points to determine the strength scatter. The material strength 
scatter, however, was fairly well represented by the material 
property coupon tests. The major source of statistical data was 
Reference 8. Most of the difficulty in gathering the strength 
scatter data was due to the lack of sufficient information on 
the conditions of the test, the test specimens, and the sample 
size. In many instances one or the other factor was not clearly 
defined so that assumptions had to be made before the data 
was correlated. 
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The data reported has been arranged in three tables which 
parallel the main classifications of Figure 14: materials, 

structural elements, and structural assemblies. The strength 
scatter (y s ) and the sample size (n) have been recorded, and 
the material, alloy, heat treatment, and form, when available, 
are described. When the information was not available, it was 
marked "unspecified." 

3.4.1 Materials 

The test data of this section are the result of coupon 
type tests. That is, the data reported are generally the pro- 
ducer's verification of the material. These data are the type 
used by the MIL-HDBK-5A committee to determine the material 
strength allowables. In some applications these data have been 
used for this purpose. The data are reported for room tempera- 
tures and tensile loading unless otherwise noted. Strength 
scatters reported are for ultimate loads. 

TABLE V. STRENGTH SCATTER DATA ON STRUCTURAL MATERIALS 


Material 

Alloy 

H.T. 

(vs) 

Form 

n 

Ref 

ALUMINUM 

2014 

T6 

.05 

sheet, bare 


8 


2014 

T6 

.04 • 

sheet, bare 


8 


2014 

T6 

■ .0507 

sheet, clad 


8 


2014 

T6 

.0415 

sheet, clad 


8 


2014 

T651 

.0264 

plate 

20 

8 


2024 

T3 

.0403 

sheet, bare 


8 


2024 

T4 

.0403 

sheet, bare 


8 


2024 

T36 

.0403 

sheet, bare 


8 


2024 

T3 

.0500 

sheet, clad 


8 


2024 

14 

.0400 

sheet, clad 


8 


2024 

T 36 

.0507 

sheet, clad 


8 


2024 

T6 

.0410 

sheet, clad 


• 9 


2024 


.04 

sheet, clad 


9 


7049 

T73 

.0653 

forging, hand 

165 

10 


7049 

. T7 3 

.0403 

forging, die 

72 

10 


7075 

T6 

.0500 

sheet, bare 


8 


7075 

T6 

.0496 

sheet, bare 


8 


7075 

T6 

.0506 

sheet, clad 


8 


7075 

T6 

.0407 

forgings 

204 

10 


7079 

T6 

.0267 

forgings 

183 

11 


356 

T6 

.0514 

casting 

-- 

8 


356 

T6 

.0695 





201 

T6 

.0279 

casting 

40 

10 


201 - 

11 

.0262 

casting 

40 

10 


201 

T43 

.0312 

casting 

40 

10 


7075 

T6 

.034 

extrusion 

-- 

9 


Unspecified 

.01-. 05 

bar, extrusion 

5500 

12 


Unspec 

if ied 

.01-. 05 

sheet 

950 

12 


Unspec if ied 

.03 

tube 

60 

12 


Unspecified 

.05-. 17 

casting 

680 

12 


Unspecif ied 

.0653 

forging 


10 

STEEL 

1035 


.0610 

bar 

913 

8 

Low Carbon 

1018 


.0795 

bar 

58 

8 


1045 


.055 

bar 

40 

8 


1117 


.063 

bar 

105 

8 


1137 


.073 

bar 

140 

8 


50 


TABLE V. - Continued 


Material 

Alloy H.T. 

(Y S ) 

Form 

n 

Ref. 

Low Carbon 12L14 

.073 

bar 

64 

8 


12L14 

.046 

sheet 

100 

8 


12L14 

.0 34 

sheet, draw qual 

160 

8 


12L14 

.037 

sheet, draw qual 

170 

8 


12L14 

.027 

sheet, draw qual 

190 

8 


12L14 

.039 

sheet, killed 

120 

8 


12L14 . 

.038 

sheet, rimmed 

180 

8 


12L14 

.072 

sheet, rimmed 

150 

8 

High Carbon 1 

.086 

sheet 

301 

8 


1 

.084 

sheet 

4 37 

8 


2 

.053 

sheet 

109 

8 


2 

.083 

sheet 

113 

8 


3 

.104 

sheet 

312 

8 


3 

.066 

sheet 

212 

8 


4 

.094 

sheet 

276 

8 


4 

.062 

sheet 

392 

8 


5 

.053 

sheet 

306 

8 


*C-%Mn 






.17-. 75 

.042 

casting 

180 

8 


.17- .75 

.041 

cast ing, tempered 

45 

8 


.20-1.25 

.049 

casting 

45 

8 


.22-. 65 

.0405 

casting, annealed 25 

8 


.24-. 60 

.049 

casting, annealed 20 

8 


.26-. 70 

.0595 

casting 

513 

8 


.28-. 70 

.0487 

casting, tempered 100 

8 


. 30-1.50 

.0625 


513 

8 


.37-. 75 

.057 

tempered 

50 

8 


.44-. 70 

.080 


513 

8 

Stainless 

201 

.038 

sheet § strip 

102 

8 


301 

.026 


17 

8 


301 

.067 


100 

8 


301 

.069 


182 

8 


304 

.0 34 

bars 

45 

8 


304 

.060 

tubing 

204 

8 


304 

.068 

tubing 

98 

8 

Stainless 

347 

.045 

tubing- 

149 

8 


301 

.057-. 061 

annealed 


4 


301 

.0599 

1/4 hard, sheet 

489 

10 


301 

. 0545 

1/2 hard, sheet 

195 

10 


301 

.0418 

3/4 hard, sheet 

224 

10 


301 

.036-. 048 

1 hard, sheet 

270 

10 


301 

.014 

.027 sheet 

6 

13 


403 

.100 

bars, rolled 

549 

8 


403 

.033 


204 

8 


410 

.068 

tubing 

88 

8 


446 

.030 

tubing 

66 

9 


17-7PH 

.050 

sheet 

106 

8 


17-7PH 

.070 


101 

8 


1 7 - 7 PH 

.070 


541 

8 


17-4PH 

.024 

bar 

101 

8 


AM-350 

.049 

sheet 

194 

8 - 


AM-350 

.071 

sheet 

93 

8 


355 

.042 

bar 

44 

8 

Super Ailoy 

Unspecified 

.01-. 02 

bar 

50 

12 


Unspecified 

.05 

casting 

190 

12 


Unspecified 

.10 

Honeycomb 
PH15-7MO core 


4- 
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TABLE V 


Concluded 


Material 

Alloy H.T. 

Cys) 

Form 

n 

Ref. 

IRON 






Malleable 

35018 

. 042S 

Unspecified 

159 

8 


32510 

.052 

Unspecified 

4 34 

8 


32510 

.040 

Unspecified 

785 

8 


BHN a 





Pearlitic 

217-235 

.053 

Unspecified 

127 

8 


217-235 

.053 

Unspecified 

172 

8 

a 

Brinell Hardness Number 

i 




Pearlitic 

197-212 

.062 

Unspecified 

229 

8 


197-212 

.043 

Unspecified 

161 

8 • 


179-192 

.064 

Unspecified 

261 

8 


163-174 

.074 

Unspecified 

143 

8 

MAGNESIUM 

Unspecified 

.02- .04 

bar 

130 

12 


Unspecified 

.07-. 19 

casting 

240 

12 

SUPERALLOY 

Nickel 

.04 

sheet 

1493 

15 


Nickel 

.045 

casting 

250 

8 

TITANIUM 

6A1-4V 

.046 

Unspecified 

2542 

8 


6A1-4V 

.049 

Unspecified 

603 

8 


6A1-4V 

.044 

Unspecified 

318 

8 


6A1-4V 

.051 

Unspecified 

115 

8 


5A1-2. 5S n 

.055 

sheet 

1640 

8 


8A1 - 2Cb -ITa 

.1815 

Unspeci fied 

15 

8 


8Mn 

.050 

Unspecified 

113 

8 


5A1 - 2 . 8Cr- 1 . 

2Fe . 080 

Unspecified 

377 

8 


4A1-3MO-1V 

.043 

Unspecified 

1426 

8 


4A1-3MO-1V 

.035 

Unspecified 

1414 

8 


16V02. 5A1 

.0425 

Unspecified 

755 

8 

BERYLLIUM 

Pure 

.0501 

sheet 

170 

10 



.0470 

sheet 

127 

10 


Unspecified 

.093 

extrusion , tubing 

10 


CA170 

.037 

strip 

66 

10 


CA170 

.0445 

strip 

66 

10 


CA170 

.039 

strip 

80 

10 


CA170 

.042 

strip 

80 

10 


CA170 

.0421 

strip 

95 

10 


CA170 

.030 

strip 

94 

10 


CA170 

.0374 

strip 

63 

10 


CA170 

.0284 

strip 

63 

10 

BERYLLIUM 

CA172 

. 0384 

strip 

132 ‘ 

10 


CA172 

.0385 

strip 

132 

10 


CA17 2 

.048 • 

strip 

132 

10 


CA172 

.033 

strip 

131 

10 


CA172 

.0392 

strip 

132 

10 


CA17 2 

.0296 

strip 

129 

10 


CA172 

. 0378 

strip 

132 

10 


CA17 2 

.0238 

strip 

131 

10 


CA175 

.0527 

strip 

92 

10 


CA175 

.0585 

strip 

92 

10 


CA175 

.0544 

strip 

95 

10 


CA175 

.0362 

strip 

95 

10 


CA172 

.05 

bar 6 rod 

125 

10 


CA172 

.0716 

bar 6 rod 

169 

10 


CA172 

.071 

bar § rod 

169 

10 • 
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3 . 4.2 


Structural Elements 


The structural element represents the sub-component 
level of a structure. Examples of items that would fall in this 
category are special forgings or castings, fittings, and fabri- 
cation details. Specific examples of structural elements might 
be rotor hub castings made for helicopters, and examples of the 
fabrication details of joints would be lap or butt joints or the 
fabrication details of honeycomb or waffle panels. Generally, the 
structural element data should be representative of the user 
form of the material to be differentiated from the producer 
form of the material, such as sheet, plate, extrusion, bar, and 
rod. The user form of the material would be the formation of spars, 
ribs, longerons, fittings, honeycombs, etc. 


TABLE VI. STRENGTH SCATTER DATA ON STRUCTURAL ELEMENTS 


Type 

Material 

Y S 

Failure Mode 

n 

Ref . 

JOINTS 

Rivets Aluminum 

.06 

shear 

1400 

12 


Steel 

.06 

shear 

900 

12 


Aluminum 

.07 

shear 

650 

12 


Steel 

.06 

shear 

85 

12 


Sheet Aluminum 

.09 

bearing tear 

1400 

12 



.09 

bearing tear 

900 

12 



.12 

bearing tear 

650 

12 



.12 

bearing tear 

85 

12 

FASTENERS 

1 Steel 

.02-. 07 

bolt nut 

130 

12 


Steel 

.02-. 07 

bolt shank 

40 

12 


Steel 

.006- .013 

shear 

25 

10 


Titanium 

.013- .026 

shear 

10 

10 


TI-6A1-4V 

.00276 

dbl shear 

15 

10 


TI-6A1-4V 

.0048 

dbl shear 

15 

10 


TI-6A1-4V 

.01029 

dbl shear 

15 

10 


TI-6A1-4V 

.01206 

dbl shear 

15 

10 


Steel 

.0376 

flush head 

95 

10 

WELDS 

Aluminum 

.08 

sheet, weld 

240 

12 


Magnesium 

.19 

sheet, weld 

400 

12 


Steel 

.10 

sheet, weld 

270 

12 


Steel 

.07 

sheet, weld 

120 

12 

' 

Steel 

.14 

tube, weld 

40 

12 
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3 . 4.3 


Structural Assemblies 


This grouping of test data pertains to the full-scale 
structural components or structural subassemblies. In general, 
statistical data on complete full-scale structures is rare. 

Usually, not more than one full-scale structure is statically 
tested to failure, and there is little evidence that any particular 
design was tested at the full-scale level enough times for a good 
statistical data point. On the other hand, structural subassemb- 
lies or component -level tests have been conducted enough times for 
an estimation of the strength scatter. 


TABLE VII. STRENGTH SCATTER DATA ON STRUCTURAL ASSEMBLIES 


Material 

Ys 

Description 

n 

Ref. 

WOODEN 

.073 

"Master" Tailplane 

60 

12 

METAL 

.02-. 03 

"Typhoon" Tailplane 

35 

12 

GLASS 

. 1 1 - . 2 9 

"Vampire" canopy pressure 

90 

12 


O 

i 

k— i 

"Vanguard", pressure 

150 

12 


.10.16 

"TSR2" tough glass, 
pressure 


12 


. 24 

Perspex, pressure 

30 

12 

Unspecified 

.01.7 

"Hudson" tailplane 

6 

18 

Unspecified 

.046 " • 

"Whitley" tailplane, 
up bending 

13 

18 

Unspecified 

.033 

"Whitley" tailplane, 
down bending 

7 

18 

Unspecified 

.060 

"Whitley" tailplane, 
torsion 

21 

18 

Unspecified 

.045 

"Mustang" wings, bending 

5 

18 

Unspecified 

.081 

"F-80" tailplane, bending 

3 

18 

Unspecified 

.099 

"F-86D" tailplane, bending 

3 

18 

Unspecified 

.10 

Large thin shells, R/t = 
4000 

5 

17 

Unspecified 

. 21 

Cylinders unpressurized 

15 


Unspecified 

.017-. 043 

Cylinders pressurized 

15 
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3 . 4.4 


Compressive Strength Data 


The following data on compressively loaded cylinders 
and shells, with and without pressurization and with and with- 
out stiffeners, was gathered from the references listed. Be- 
cause of the variety of failure modes (FM) associated with com- 
pressive loading, the failure modes have been included in the 
table, where possible. Although most of these data points 
represent experimental data on small thin shells and cylinders, 
the results still illustrate the large scatters in compressive 
loading. Full-size structures can be expected to exhibit as 
large a strength scatter as these data indicate. Since geometry 
of the structure plays a large role in determining the strength 
scatter for compressive loads, the dimensions of the test specimen 
were noted with as much detail as possible. The strength scatter 
is sensitive to the sample size, and, therefore, this should be 
considered in using the table. 


TABLE VIII. STRENGTH SCATTER DATA FOR ELEMENTS IN 
COMPRESSIVE LOADING 


Material 

FM 

YS 

Description 

Dimensions 

n 

Ref 

7075 

-T6 

bk' 

.092 

Stiffened Cylinder, 
Pressurized 

L(in) 

30 

R/t 

680 

3 

19 

7075 

-T6 

BK 

.071 

Stiffened Cylinder, 
Pressurized 

15 

680 

3 

19 

2S-H 

-18 

BK 

.186 

Unstiffened 

Pressurized 

Cylinder , 

21.5 

1750 

3 

20 

18-8 

Steel 

BK 

.078 

Unstiffened 

Pressurized 

Cylinder, 

21 . 5 

1006 

4 

20 

18-8 

Steel 

BK 

.146 

Unstiffened 

Pressurized 

Cylinder , 

21.5 

1006 

4 

20 

18-8 

Steel 

BK 

.138 

Unstiffened 

Pressurized 

Cyl inder , 

21.5 

1006 

3 

20 

18-8 

Steel 

BK 

.065 

Unstiffened 

Pressurized 

Cylinder, 

21.5 

2734 

6 

20 

18-8 

Steel 

BK 

.125 

Unstiffened 

Pressurized 

Cylinder, 

9.5 

2734 

3 

20 

18-8 

Steel 

BK 

.065 

Unstiffened 

Pressurized 

Cylinder, 

9.5 

2734 

3 

20 

18-8 

Steel 

BK 

.055 

Unstiffened 

Pressurized 

Cylinder 

21.5 

2734 

7 

20 

18-8 

Steel 

BK 

.090 

Unstiffened 

Pressurized 

Cylinder, 

21.5 

2734 

7 

20 

18-8 

Steel 

BK 

.096 

Unstiffened 

Pressurized 

Cylinder, 

21.5 

2734 

4 

20 

18-8 

Steel 

BK 

.133 

Unstiffened 

Pressurized 

Cylinder, 

21, 5 

2734 

7 

20 
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TABLE VIII. - Concluded 


Material 

FM 

Ys 

Description 

Dimensions 

n 

Ref. 

NA 

BN 

.478 

Unstiffened Cylinder 
Unpressurized 

Z 

, ' 330 

4 

21 

NA 

BN 

.445 

Unstiffened Cylinder 
Unpressurized 

, 1350 

6 

21 

NA 

BN 

.635 

Unstiffened Cylinder 
Unpressurized 

, 3000 

3 

21 

NA 

BN 

.485 

Unstiffened Cylinder 
Unpressurized 

, 4000 

3 

21 





L ( in) R/t 



NA 

BK 

.05 

Spherical Shell, 
Honeycomb 

1450 

3 

22 

S-glass 

Epoxy 

CF 

.119 

Cylinder, helical 
wound 

2.0 425 

3 

23 

FRP 

NA 

.098 

Cylinder, honeycomb 

72 117 

7 

24 

FRP 

NA 

.087 

Cylinder, honeycomb 

72 117 

4 

24 

FRP 

BK 

.154 

Curved Panel, 
Cylindrical 

NA 

3 

24 

FRP 

BK 

.122 

Flat Panel, Sandwich 

NA 

15 

22 

NA 

LYC 

.0923 

Stiffened Cylinder 

t 

.020 

4 

26 

NA 

GI 

. 509 

Cylinder, Waffle 
0° -90° 

NA 

9 

26 

NA 

LI 

. 250 

Cylinder, Waffle 
0° -90° 

NA 

7 

26 

NA 

GI 

.368 

Cylinder, Waffle 45° 

NA 

6 

26 

NA 

LI 

.182 

Cylinder Waffle, 45° 

NA 

6 

26 

NA 

GI 

.333 

Stiffened Cylinder, 
Stringers 

NA 

6 

26 





t R 



NA 

GI 

.484 

Stiffened Cylinders, 
T-stif feners 

.1851 459 

6 

26 


Symbol 

Definition 

Symbol 

Definition 

BK 

Buckling 

LYC 

Local Yielding 

BN 

Bending 

GI 

General Instability 

CF 

Compressive Fracture 

LI 

Local Instability 

NA 

Information Not Available 

Z 

L 2 /Rt (1-p 2 ) 1 / 2 
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4. 


EXAMPLES 


In order to illustrate the application of the QSDC Method- 
ology as described in Section 2 and the use of the strength 
scatter data compiled in Section 3, the following examples were 
devised. Each example is intended to demonstrate the concepts 
which are unique to the QSDC Methodology and perhaps puzzling 
to the designer accustomed to the Present System. Examples 
4.1 and 4.2 illustrate the definition of design conditions, 
both Limit and Omega, for controllable and •noncontrollable oper- 
ational conditions, respectively. Example 4.3 demonstrates 
the use of strength scatter data in a material trade-off anal- 
ysis with the QSDC Procedure. A problem of designing for an 
elevated temperature environment is treated in Example 4.4. 
Example 4.5 is concerned with design for combined conditions, 
utilizing the QSDC Methodology. 

4 . 1 Illustration of Design Condition Definition by Operational 

Restriction 

During the launch phase of the Space Shuttle mission, the 
decrease in vehicle weight due to fuel consumption would result 
in a continuously increasing longitudinal acceleration for a 
constant engine thrust. The load factor resulting from this 
operation would be a severe operational condition imposed on 
the structure. A reasonable solution to this problem is to 
control the thrust level to restrict the load factor to an ac- 
ceptable range. Thus, an example of an operational condition 
that would require a restriction would be the longitudinal load 
factor (LLF) . The restriction is necessary to optimize the 
structural weight. As a particular case, it is assumed that 
a hypothetical analysis yields a 3.0 restriction on the LLF. 

An illustration of the nominal longitudinal load factor versus 
time is shown in Figure 16. The restriction to 3.0 is shown 
as the solid line labeled "CONTROLLED." The dashed line labeled 
"UNCONTROLLED" represents the nonres tricted longitudinal load 
factor. 

The Limit and Omega Conditions can be defined by the 
variation in longitudinal load factor produced by the control 
system. A typical control system can be expected to control 
the thrust so that the resulting LLF will not exceed 105 percent 
of the nominal 3.0 value. Only in very rare cases, such as 
a gross malfunction, would the thrust control system allow 
the LLF to exceed 120 percent of the nominal value. Assuming 
that the nominal value of the condition is exceeded half of 
the time, the three points can be used to produce a cumulative 
probability of exceedance curve of longitudinal load factor 
as in Figure 17. The terms "usually" and "almost always" can 
be interpreted as probabilities of 0.01 and 0.0001, respectively. 
These values are consistent with the levels of cumulative proba- 
bility used to define the Limit and Omega Conditions for the 
standard S. R- goal 0-9999 (see Table III) and will be used 
in this hypothetical example. 
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Figure 16. Typical Longitudinal Load Factor versus Time for 
Controlled and Uncontrolled Thrust 



o~ PERCENT LIMIT LONGITUDINAL LOAD FACTOR 


Figure 17. Typical Probability of Exceedance of Longitudinal 
Load Factor versus Percent Limit Longitudinal Load 
Factor for Controlled Thrust 


58 



Note that the Limit and Omega Conditions could be established 
deterministically. If the 105 percent of Limit Condition (3.15G) 
satisfies criteria similar to those ordinarily used in establish- 
ing Limit Conditions such as in NASA SP-8057 (Reference 2), it can 
be considered to meet the QSDC requirements: 

(1) Qualitatively, the Limit Condition should be the 
upper boundary of normal and expected operational 
conditions . 

(2) The Limit Condition should impose little, if any, 
limitation on operational. usage during the planned 
mission. 

(3) There should be general agreement among all con- 
cerned (structural and propulsion systems, mission 
planning, program manager, etc.) that any exceed- 
ance of the Limit Condition will result in an in- 
vestigation to determine the cause and corrective 
action to prevent future exceedances . 

All concerned should agree that the Omega Condition, 120 percent of 
the Limit value (3.6G), meet the following criteria: 

(1) The Omega Condition can occur only as the result of 

a gross malfunction of the propulsion control system. 

(2) If a catastrophic structural failure occurs at or be- 
yond the Omega Condition, the failure will not be 
considered the responsibility of the structural 
system. 

(3) The correction action for such a gross malfunction 
will be to modify and improve the performance and 
reliability of the propulsion control system. 

These criteria for defining the Limit and Omega Conditions 
require decisions by the responsible management which can be 
reduced to yes or no answers. As noted, the Limit Condition 
is essentially the same as the traditional Limit Condition. 

There is no intent to change the procedures already established 
for defining Limit Conditions. However, more consistent Limit 
Conditions would result if the criteria were quantitized as 
shown in Table III. 

Omega or overload conditions have generally not been defined 
in the past with the exception of some ultimate conditions, 
notably landing impact and crash loads. However, there has 
always been an implicit definition for such conditions. In 
the event of a catastrophic failure, an accident investigation 
group is usually convened to establish the "probable cause." 

In many cases, the probable cause resides in a nonstructural 
system and no corrective action is required. If no structural 
system has been judged responsible after the fact, it seems 
reasonable that the same decision can be made in advance. 
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The next step of the design procedure would be to determine 
the design and test factor of safety (TFS) for the Limit and 
Omega Conditions. From Figures 6 and 7 the LTFS and OTFS for 
the condition can be found according to the scatter in structural 
strength. The boos ter-orbiter attachment fitting is selected 
as a typical structural component to illustrate this application 
of the QSDC Procedure. It is assumed that the attachment fitting 
will be a 7075-T6 aluminum forging. To simplify the problem, 
no elevated temperature effects are considered. 

The strength scatter for a 7075-T6 forging is 0.0407 from 
the data in Section 3.4. Entering the curve of Figure 6 with 
this value for the strength scatter, a desired design structural 
reliability of 0.9999, and a qualification requirement of one 
static test yields an LTFS of 1.24. A similar use of the curve 
in Figure 7 gives an OTFS of 1.0. 

If these factors were applied to the loads produced by the 
Limit and Omega Conditions (here the 3.15G and 3.60G refer 
to loads and not conditions), the design load of 3.90G for 
the Limit Condition and the design load of 3.60G for the Omega 
Condition would result. The more severe of the two loads, namely 
the 3.90G load, is chosen as the design load for the attachment 
fitting. This choice insures a sufficient reserve against 
understrength and some capability above the requirement to sur- 
vive overloads . 

The Present System (1.5FS) would determine the Limit Condi- 
tion from the nominal value of the restricted operational con- 
dition and the variation of conditions about this nominal. The 
load that corresponds to the Limit Condition 3.15G is multiplied 
by 1.5. The resulting Ultimate Load of 4.72G is used as the de- 
sign point. In comparison with the QSDC Procedure, the Present 
System would tend to overdesign the structure by 21 percent. 

4 . 2 Illustration of Design Condition Definition for Noncontrol - 

lable Operational Conditions 

Of the conditions chosen as operational conditions, those 
that describe the natural environment are noncontrollable . For 
example, the encounter of gusts in atmospheric flight is beyond 
the control of either the structural system or any non-structural 
system. The avoidance of severe thunderstorms may be a form of 
control, but this is only a partial control; it excludes consid- 
eration of the maximum velocity gusts. The range of average 
gust velocities is not avoided- and such velocities form a non- 
controlled operational condition. This noncontrollable condition 
could be contrasted with the controllable operational condition 
of the longitudinal load factor used in Example 4.1. In the 
latter, the propulsion system organization can control the thrust 
and thereby control the longitudinal load factor; whereas in the 
former no non-structural system can control the gust velocity. 

The structural system must provide sufficient strength to survive 
the Limit Condition without failure and sufficient strength for 
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overloads. It can be shown that the Present System does not pro- 
vide for overloads sufficiently by simply using the 1.5 factor 
of safety. In contrast, the QSDC Procedure does not depend on the 
factor of safety to provide for the overload capability in strength. 
Rather, it utilizes a specific design requirement for overloads, 
the Omega Condition. 

To illustrate the lack of overload capability provided by 
the Present System, consider the design of the structure for the 
symmetrical, vertical gust encountered in atmospheric flight. 

In particular, consider the criteria set down by Reference 27 
and used in Reference 2 for symmetrical vertical gusts. A cri- 
terion, the Limit Condition, for gusts is a 50 feet per second de- 
rived gust velocity (Ud e ) for the maximum level flight velocity 
(V H ) . The condition, gust velocity, is converted to the vehicle 
response, and then interpreted in the design process as the nor- 
mal load factor (N z ) . As a load factor, the criterion for sym- 
metrical gusts becomes a specific design requirement that can be 
met. For our example of a 50 feet per second gust at Vpj, the 
incremental load factor due to the gust is 1.5G. The incremental 
load factor is linearly dependent on the gust velocity: 

AN Z = k Ud e 

where k = 0.03 (ft/sec)' 1 for this example. The load factor exper- 
ienced in level flight (1.0G reference) would then be 2.5G for 
positive (up) gusts and -0.5G for negative (down) gusts. Assuming 
that the internal loads associated with the 2.5G load factor and 
-0.5G load factor can be represented by these load factor values, 
the ultimate loads would then be represented by the Limit Load 
Factors multipled by 1.5. The ultimate load for positive (up) 
gusts would be represented by 3.75G, and the ultimate load for 
negative (down) gusts would be represented by -0.75G. These loads 
would represent increments in load factor of +2.75G and -1.75G 
which are not symmetrical about the 1.0G level flight reference. 
Interpreting these load factors in terms of gust velocities, the 
ultimate loads represent gust velocities of 91.7 feet per second 
for positive gusts and -58.4 feet per second for negative gusts. 

The 1.5 factor of safety does not provide much overload capability 
for negative gusts, but it does provide a large overload capa- 
bility for positive gusts. Although it has provided sufficient 
strength for the ±50 feet per second symmetrical, vertical gust 
as a Limit Condition, it has not provided for a symmetrical gust 
greater than 58.4 feet per second (with the exception of addi- 
tional positive gust capability) . The design problem of defin- 
ing a sufficient overload would arise from having the different 
gust velocities of +91.7 feet per second and -58.4 feet per 
second for positive and negative gusts. If, on the one hand, 
the ±58.4 feet per second gust is sufficient as an overload con- 
dition then the design for positive gusts (+91.7 feet per second) 
is too severe and could be reduced. On the other hand, if the 
±91.7 feet per second gust is the proper value for an overload 
gust condition then the structure is understrength for the 
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negative gusts (-58.4 feet per second) and the strength should be 
increased. 

The QSDC Procedure avoids the confusion that could result 
from depending on the factor of safety to provide overload capa- 
bility in strength. The QSDC provides for the overload capability 
in strength by specifying a separate and distinct design condi- 
tion for overload, the Omega Condition. Sufficient strength at 
this condition is insured by the Omega Design and Test Factor 
of Safety (OTFS) applied. The Present System provides some over- 
load capability by applying a factor of safety (typically 1.5) 
to the Limit Loads. The increment in operational overload capa- 
bility is indeterminate and may vary from one design to the next. 

The QSDC Procedure specifies the Limit and Omega Conditions 
on the basis of their probability of exceedance (see Section 2.2.2, 
Table III). For the example of the symmetrical, vertical gust en- 
countered in high-speed level flight, the QSDC would specify the 
Limit and Omega Conditions from a probability of exceedance curve, 
such as in Figure 18. Assuming that the booster or orbiter struc- 
tures are designed for the standard reliability goal of 0.9999, 
the probability of exceeding the Limit and Omega Conditions would 
be 1 x 10 _ 2 and 1 x 10 ' 4 , respectively. From the figure, the Limit 
Condition would be a ±50 feet per second gust, as in the Present 
System, and the Omega Condition would be ±79 feet per second gust. 

The criteria, the Limit and Omega Conditions, are then interpreted 
in terms of normal load factor (N z ) , as in the Present System. 

The incremental load factor due to the Limit Condition is ±1.5G 
as before, and the incremental load factor due to the Omega Condition 
is ±2.37G. The load factors at high-speed level flight would 
be +2.5G and -0.5G for positive and negative Limit gusts and +3.37G 
and -1.37G for positive and negative Omega gusts, respectively. 

To insure sufficient strength for the Limit and Omega Conditions, 
the Design and Test Factors of Safety (TFS) of Figures 6 and 7 are 
applied to the loads on the structure. For the standard relia- 
bility goal and an assumed strength scatter for the booster or 
orbiter structure of 0.05, the Limit Design and Test Factor of 
Safety (LTFS) of Figure 6 would be 1.32. The Omega Design and 
Test Factor of Safety (OTFS) for the specified reliability and 
strength scatter would be 1.0 (see Figure 7). The booster and 
orbiter structure would then be designed to the most critical 
positive and negative loads associated with the Limit and Omega 
Conditions. The Design loads for the Limit Condition are the 
product of the Limit Loads (represented by the load factor of 
+2.5G and -0.5G) and the LTFS (1.32). Thus the Design Loads for 
the Limit Condition are 3.30G and -0. 66G for the positive and nega- 
tive Limit gust Conditions, respectively. The Design Loads for 
the Omega Condition, similarly, are the product of the Omega 
Loads (load factors of 3.37G and -1.37G) and the OTFS (1.0). 

Since the OTFS equals 1.0, the Design Load for the Omega Condi- 
tion equals the Omega Load: 3.37G for positive gusts and -1.37G 

for negative gusts. By designing for the +3.37G and -1.37G load 
factors, sufficient strength is provided for the overload require- 
ment represented by the gust condition of ±79 feet per second. 
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Figure 18. Typical Number and Probability of Exceedance of 
Gust Velocities per Mile of Flight versus Gust 
Velocity 

In comparison, the Present System designs to a +3.75G and 
-0.75G load factors and thus provides sufficient strength for the 
understrength requirement represented by the ±50 feet per second 
gust. The resulting overload capability is for a +91.7 feet per 
second gust and a -58.4 feet per second gust, which is not truly 
representative of an overload requirement for symmetric gust ve- 
locities. 


4 . 3 Illustration of Material Trade-Off Through the QSDC Procedure 

This example will show a technique for making material trade- 
offs based on the strength requirements of the QSDC Procedure. 

The subject will be the engine support truss of the launch vehi- 
cle. For simplicity, the thrust distribution of Figure 3 is 
assumed. The Limit Condition is assumed as the 1:100 occurrence 
value in thrust, and the Omega Condition is assumed as the 1:10,000 
occurrence value in thrust. From the figure, the Limit thrust is 
1,000,000 pounds - force . The Omega thrust is 1,200,000 pounds-force 
(The choice of Limit and Omega values is based on the standard 
structural reliability goal (0.9999) with one static test). 

The materials to be considered for trade-offs in this example 
are tubing of (1) steel, (2) beryllium, and (3) Lockalloy. The 
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steel tubing used will be Type 304 in the annealed condition. 

From the strength scatter data of Section 3, the strength scatter 
coefficient for this steel tubing equals 0.060. The correspond- 
ing LTFS (from Figure 6) for the structural reliability indicated 
above is 1.41 and the OTFS (from Figure 7) is 1.0. 

The Design Load for the Limit Condition is computed for the 
steel tubing: 

Design Load for Limit Condition = LTFS x Limit Load 

= 1.41 x 1 x 10 6 pounds 
= 1.41 x 10 6 pounds-force 

and the Design Load for the Omega Condition is computed: 

Design Load for Omega Condition = OTFS x Omega Load 

* 1.0 x 1.2 x 10 s 
= 1.2 x 10 6 pounds-force 

Of the two Design Loads computed in the above manner, the 
greater load is used as the critical load; in this example the 
Design Load for the Limit Condition is used. (Note that this 
means that more strength is needed to provide a reserve against 
understrength than to provide a capability for overloads) . The 
structure is then designed for the critical load in the same 
fashion as in the Present System. 

The material trade-offs in this example will be based on 
the weight of the material required to obtain a design with the 
structural reliability specified. The Type 304 steel tubing will 
be used as the base line. From Reference 28, Table 2. 8. 1.1, the 
reported ultimate tensile strength for Type 304 steel is 75000 
pounds per square inch and the density is 0.286 pounds per cubic 
inch. The strength to weight ratio is: 

Strength to Weight Ratio = Strength t Weight 

= 75000 lb in 3 
in 2 .286 lb 

= 2.62 x 10 5 lb :A n 

lb 

For the second material, beryllium, the strength scatter 
coefficient is approximated from the typical histogram represent- 
ing test results of the failing load for beryllium tubing as shown 
in Figure 19 as follows: 

y = HI-LO 
S 2 (HI+LO) 

155-85 

2(155+85) 

= .146 
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where HI is the largest observed strength and LO is the smallest 
observed strength in the test results. When this strength scatter 
and the standard reliability goal are used, the LTFS (from Figure 
6) is 2.85 and the OTFS (from Figure 7) is 1.09. 



FAILING LOAD (KSI) 

Figure 19. Typical Histogram of Number of Failing Articles 
versus Failing Load for Beryllium 

Once again, the Design Loads for Limit and Omega Conditions 
are computed. The Limit and Omega Loads remain at 1 x 10 6 pounds 
and 1.2 x 10 6 pounds, respectively , but the LTFS and OTFS have 
increased, making the Design Loads 2.85 x 10 6 pounds for Limit 
and 1.31 x 10 6 pounds for Omega. Since the Limit Design Load is 
critical for this material, the structure is designed to sustain 
2.85 x 10 6 pounds. (Note that the Design Load for the Limit Con- 
dition for beryllium structure is different from the Design Load 
for the Limit Condition for the steel structure) . The strength- 
to-weight ratio for beryllium is 5.97 x 10 s pounds-force inches 
per pound-mass as computed from the data in Table 9. 2. 1.1 of 
Reference 28. 


The required weight of steel and beryllium structure can be 
computed by dividing the Design Load by the strength- to-weight 
ratio ; i . e . , 

Required Weight = Design Load t Strength/Weight 

The required weight of the steel tubing is: 

= 1.41 x 10 6 lbs v 2.62 x 10 s lb ~ in 

lb 

= 5.39 lb 
in 


and for the beryllium: 


= 2.85 x 10 6 
= 4.78 

in 


lbs 


5.97 x 10 s lb ~ in 
lb 
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Taking the beryllium- to-steel ratio, the relative weight of 
beryllium to steel for the thrust structure becomes: 

4.78 lb 

in 3 

5.39 lb 
in 3 

Thus, .887 pounds of beryllium could be used with the same 
reliability as 1 pound of steel. This ratio is less favorable 
to beryllium than obtained if a uniform factor of safety were 
used for both materials as in the Present System. However, be- 
cause of the higher strength scatter associated with beryllium, 
the gain in weight saved in the structure is traded for a con- 
sistent level of reliability. 

For the Lockalloy tubing, the same comparison can be made. 
Starting with a histogram similar to Figure 19, a strength scat- 
ter can be derived (no data available). For the sake of this 
example, the strength scatter is assumed to equal 0.07. Refer- 
ring again to Figures 6 and 7 with this value for the strength 
scatter and the standard structural reliability goal, the values 
of LTFS and OTFS are 1.51 and 1.0, respectively. The design 
load for Limit and Omega Conditions are, therefore, 1.51 x 10 6 
pounds and 1.2 x 10 6 pounds, equalling the product of the Limit 
and Omega Loads and the TFS, respectively. 

Assuming the strength to weight ratio to be 3.54 x 10 5 
pound-force inch per pound-mass, the required weight of Lockalloy 
is : 

1,5. x 10 6 lb 4 26 

3.54 x 10 s lb-in ‘ m 

lb 

and the relative weight of Lockalloy to steel is: 


= .887 or 1 

T7TTS 


4.26 lb/in = .790 
5.39 lb/in 

Thus, .790 pounds of Lockalloy will produce the same reliability 
as 1 pound of steel. 

The strength- to-weight ratio of Lockalloy is lower than that 
of beryllium; but the more consistent failing strength, as re- 
flected by the lower strength scatter, permits a lower LTFS and 
a lighter weight, more efficient structure. The inconsistency 
in strength of the more brittle material, beryllium, as reflected 
in the higher strength scatter, requires larger factors of safety 
to provide the needed structural reliability. 

In conclusion, the minimum weight structure can be made with 
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the Lockalloy material, even though the Design Load is higher than 
that for steel. Although this example is greatly simplified, it 
illustrates the trade-off technique that can be employed in the 
design process . 


4 . 4 Example of Thermal Considerations in Designing with the 
QSDC Procedure 


In order to demonstrate an application of the QSDC Procedure 
(References 1 and 5) to a problem involving elevated temperature 
environment for a structure, the following hypothetical problem 
is presented. Consider the design of a beam element of the sup- 
port structure of the ablative heat shield of an Apollo-type entry 
vehicle. The beam must be designed to carry a uniformly distributed 
pressure of w pounds per inch as shown in Figure 20. 
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W( lb/ in) 


Figure 20. Typical Beam Loading for Heat Shield Support 


During the entry the ablative shield can be expected to con- 
duct a certain amount of heat energy into the beam, resulting in 
a temperature rise and a strength degradation of the structure. 

The following assumptions are made: 

1) No thermal stresses exist in the beam. 

2) There is no inelastic material behavior during 
the entry. 

3) The entire effect of temperature is a reduction 
of the material strength. 

4) The load and temperature experienced by the struc- 
ture are specified by the trajectory of the entry. 

5) The entry trajectory is fully specified by the 
entry velocity, V. 

Utilizing these assumptions the QSDC procedure can be applied 
in four steps: (L) establish Limit and Omega Conditions (defined) 

in Section 2.2.2); (2) establish Limit and Omega Loads (Section 
2.2.3); (3) obtain design Limit and Omega Loads (Section 2.2.4); 
and (4) design for the most critical design load to obtain a zero 
margin of safety at that load (Section 2.2.5). 

The QSDC Procedure requires that two separate and distinct 
conditions be established for any operation. These conditions 
are the Limit Condition, that condition which can be expected to 
occur during normal operation of the vehicle, and the Omega 
Condition, which is not expected to occur during normal operation 
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but is considered to be possible. Generally, exceedance of 
the Limit Condition should be an infrequent occurrence, say a 
probability of exceedance of 10" 2 . Exceedance of the Omega 
Condition should be very rare, say a probability of exceedance 
of 10“ 4 . These conditions are then said to specify the particu- 
lar operation. 


In the hypothetical problem, the organization responsible 
for controlling the entry velocity would be required to utilize 
past statistics, rational analysis, experience, judgement, and 
any other means to establish the Limit and Omega entry trajec- 
tories by defining the Limit and Omega Conditions for entry 
velocity. If there were insufficient past statistical data on 
this problem, the responsible organization might conclude that 
on the basis of rational analysis and judgement, an entry of 
37000 feet per second is the maximum velocity required for normal 
operations and mission success and that an entry velocity of 
41000 feet per second is the worst-possible velocity that could 
result. These then become the Limit and Omega Conditions, re- 
spectively, and are binding requirements on the group responsible 
for the entry velocity. 


A graphical representation of this state of affairs 
given in Figure 21. 
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Figure 21. 


Typical Probability of Exceedance of Entry Velocity 


Once the Limit and Omega Conditions have been established, 
the following are true: 

(1) Any condition below Limit must not result in a 
structural failure. 

(2) Any condition greater than Limit but less than 
Omega must be survivable by "most" structures. 

The loads that the structure encounters during each dis- 
crete condition must now be obtained for the structural designer. 
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The QSDC Procedure specifies two levels of external loading 
that must be considered during the design. The Limit Load is 
defined as the most critical load associated with the conditions 
within the Limit Condition envelope, and the Omega Load is 
the most critical load associated with the conditions within 
the Omega envelope. In many cases the Limit and Omega Loads 
are found to correspond directly to the Limit and Omega Condi- 
tions, thus eliminating the need to consider other conditions. 
For the example problem, assume this correspondence holds: 


LIMIT CONDITION: 
LIMIT LOADS: 

OMEGA CONDITION: 
OMEGA LOADS 


V = 37000 fps 

W = 100 lbs/in 
T = 500 °F 

V = 41000 fps 

W = 123 lbs/in 
T = 800°F 


Note that there is no factorial relationship between the Limit 
and Omega Loads. These loads arise from two separate require- 
ments and as such are dependent only on the transfer function 
between the Limit and the Omega Condition and the local loads 
on the component under consideration. 


It now becomes the structural designer's problem to design 
the structure so that (1) "no" failure can be expected at the Limit 
Condition and (2) most vehicles can be expected to survive to the 
Omega Condition. To accomplish these goals, the QSDC Procedure 
defines Design Limit and Omega Loads that are loads for the Limit 
and Omega Conditions obtained by multiplying the Limit and Omega 
Loads by appropriate factors of safety. These factors, known as 
the Limit TFS and the Omega TFS , are shown on Figures 6 and 7. 

They were derived in Reference 1 to account for the observed scat- 
ter in strength, the meaning attached to the term "most" used 
above (i.e., the structural reliability goal), and the number 
of independent tests that the resulting structure must pass for 
design qualification. The design loads are determined as follows: 


DESIGN LOAD FOR THE LIMIT CONDITION = LIMIT LOAD X LIMIT TFS 
DESIGN LOAD FOR THE OMEGA CONDITION = OMEGA LOAD X OMEGA TFS 


For the example problem, suppose that the structure will 
have one test, the structural reliability goal is standard, and 
the strength- temperature envelope is given in Figure 22. The 
statistical scatter in the strength can be approximated from the 
envelope using the procedure of Section 3.3.1 as: 

( x s ) 70 = 0.051 ( Y s ) 500 = 0.058 ( Y S )800 = °- 063 

Utilizing the TFS curves of Figures 6 and 7 and the allowable 
ultimate stress given in Figure 22, the following can be shown: 
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(Ys^SOO = 0-058; therefore, LIMIT TFS = 1.39 
CFT U )500 = 54 KSI 

(Ys) 800 = 0.-063; therefore, OMEGA TFS = 1.00 
< F Tu 5 800 = 35 KSI 

Consequently, the design loads are as follows: 

DESIGN LOAD FOR LIMIT: W = 100 x 1.39 = 139 lbs/in 

T = 500° F 

DESIGN LOAD FOR OMEGA: W = 123 x 1.00 = 123 Ibs/in 

T = 800° F 



Figure 22. Typical Strength vs . Temperature Curve for the 
Heat Shield Support Material 


The designer must now provide a zero margin of safety for 
the most critical of the two design load cases given above. If 
Fy is the maximum stress for a rectangular cross section of 
fixed depth, the designer requires that 


F T C W < , n 

F x AF T 
x u 


where C is a constant and A is the cross-sectional area of the 
beam. Then for 


DESIGN LIMIT LOADS: A 


C W 

^Tu^OO 


>0.262 


10' 2 C 


DESIGN OMEGA LOADS: A 


c w 

(F T U ^800 


>0.352 


10' 2 C 
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Thus, the Omega Condition is the critical condition, requiring 
the larger beam cross section. 

If the conventional l.S factor of safety were applied to the 
Limit Loads, the required area would be 0.283 x 10" 2 C. Since this 
is 20 percent less than that required for the Omega Condition, 
failure would occur at a velocity between Limit and Omega. The 
probability of exceedance of this failure condition (with 1.5 F.S.) 
would be greater than the 10" 1 * value for the Omega Condition. Thus, 
the conventional 1.5 factor of safety would not provide the desired 
standard structural reliability. 

The general problem associated with a space shuttle entry, 
although much more complicated, is basically the same as the illus- 
trated problem. For instance, NASA SP-8057 (Reference 2) cur- 
rently indicates that the entry trajectories of the shuttle can 
be restricted to a nominal trajectory corridor and that the design 
may be based on this nominal corridor plus some dispersion. In 
the QSDC terminology this design corridor then becomes the Limit 
corridor. Similarly, an Omega corridor, reflecting the very rare 
excursion out of the Limit corridor, can be defined. Figure 23 
indicates the relationships that might exist. Then, for any par- 
ticular part of the structure, the requirements of (1) "no" failure 
wi'thin the Limit corridor and (2) "most" survive within the Omega 
corridor must be met. 



Figure 23. Typical Entry Trajectories 


Of course, many of the limiting assumptions on the struc- 
tural behavior at elevated temperatures will need to be relaxed 
since creep can occur, thermal stress may be present, permanent 
degradation of material strength will be present, temperature 
distributions may not be uniform, and so on. However, to 
account for the temporary loss in strength due to elevated 
temperature, the QSDC Procedure can be applied as it stands. 
Consideration of more complex problems will require some modi- 
fication of the procedure, but the basic philosophy should 
carry through. 
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4 . 5 Illustration of Design Condition Definition for Combined 
Conditions 


The QSDC Procedure handles the problem of combined loads in 
much the same manner as the Present System. However, as in the 
single load case, a specific overload requirement is established. 
The Present System defines the Limit strength requirement for 
combined loads as the ability to sustain all the Limit Loads 
simultaneously. The QSDC Procedure defines the Limit strength 
requirement in the same manner but with one variation: The Limit 
strength requirement for combined loads is defined as the ability 
to simultaneously sustain all the Limit Loads which are the re- 
sult of the combined operational conditions experienced. 

For example, consider the combination of two loads: the 

first being the compressive load produced in the "stack" by 
the action of the thrust, inertia forces, and aerodynamic drag. 

A typical Limit axial load distribution for a shuttle-type 
booster might be illustated by Figure 24 where the negative 
values shown are compression. The second load considered will 
be the tension and compression loads produced by the response 
of the structure to a gust encounter. Assume that the gust 
occurs during the ascent phase and normal to the flight path 
and that the loads are the result of an induced bending moment. 
The Limit bending moment as a function of the body station of 
the booster is shown in Figure 25. 
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Figure 25. Typical Limit and Omega Bending Moment Distribution 
for Gust Encounter 


For our example, the body station at 1500 inches (hypothetically, 
an intertank section) has been determined as the critical station 
for the above combined loads. From Figure 24 the axial load 
equals 2.1 x 10 5 pounds compression, and the bending moment from 
Figure 25 is 28,000 inch-pounds. The two loads may be combined 
to produce the Limit Load for the combination of thrust and gust 
encounter. The Limit Load for the combined loading is shown as 
the combined Limit spanwise load distribution in Figure 26. 



Figure 26. Typical Spanwise Load Distribution at Body Station 
1500 for Combined Loads (Present System) 
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Note that a zero load requirement exists at point B on the 
structure. If the present system were employed here to. define 
the overload requirement for tension, the structure would have 
no overload capability. (The Present System assumes that the 
1.5 FS accounts for the overload condition.) By multiplying the 
zero tension requirement by 1.5, the Ultimate Load would still 
be zero in tension; hence, there is no increase in capability 
and, therefore, no overload capability. 

It is recognized that designing for the Limit Load by it- 
self is not sufficient. The Present System employs a 1.5 FS to 
insure that the strength will be sufficient for the Limit Loads 
and to provide for a sufficient overload capability. Similarly, 
the QSDC Procedure employs a factor of safety (the LTFS) to in- 
sure that the strength will be sufficient for the Limit Loads, but 
the overload capability is defined by a separate requirement, that 
is, the Omega Condition and its factor of safety, the OTFS. This 
method ensures that the overload capability is designed into the 
structure, whereas the Present System can only imply a true over- 
load capability. The following example will illustrate what 
is meant. 

Considering the combined Limit Load distribution of Figure 
26, the Present System would define the combined Ultimate Load 
distribution by multiplying the combined Limit Load distribution 
by the 1.5 factor of safety as shown in the figure. Note that the 
maximum compressive load (at point A) has a discrete overload 
capability (the difference in load from the Limit curve to the 
Ultimate curve) and that the minimum compressive load (at point B) 
has no overload capability. That is, the zero compressive load 
factored by 1.5 is still a zero compressive load; hence, there is 
no difference in load and no overload capability. Obviously, 
since the vehicle is symmetrical, the maximum compressive load 
would provide more than enough overload capability for the minimum 
compressive load. However, if the minimum compressive load were 
to become a tensile load, there is no coverage of this strength 
requirement by the maximum compression load. A tensile load at 
point B can result from either a higher bending moment than expected 
or a lower thrust loading with the same bending moment. The Present 
System, however, cannot consider these overload possibilities by 
simply factoring the Limit Loads by the factor of safety to 
obtain an "overload” capability. 

The QSDC Procedure, however, does consider the overload condi- 
tions separately and discretely from the Limit Conditions. (There- 
fore, the true overload condition is considered.) The load distri- 
bution for the Omega level of thrust and of the condition of gusts 
encountered are shown in Figures 24 and 25. A discussion of how 
the Omega level of combined conditions is determined can be found 
in Section 2.2.2. The spanwise load distribution at the Omega level 
of each condition would appear as in Figure 27. The QSDC Procedure 
defines the combined Omega Load distribution as follows: The 

Combined Omega Load distribution for two loads is defined by two 
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separate distributions where the Omega Load distribution of one 
condition is combined with the Limit Load distribution of the 
other. In our example, the combined Omega Load distribution for 
the conditions of thrust and gust encountered by a hypothetical 
vehicle at station 1500 would be as follows: The spanwise Omega 

Load distribution due to the thrust (from Figure 27) is combined 
with the spanwise Limit Load distribution due to the gust (from 
Figure 26) for the first of the combined Omega Load distributions 
(Omega 1, Figure 27). The second combined Omega Load distribution 
(Omega 2) is defined as the sum of the spanwise Omega Load distri- 
bution due to the gust (Figure 26) and the spanwise Limit Load 
distribution due to the thrust (Figure 27) . By taking the larger 
value of load from either of the Omega Load distributions, the com- 
bined Omega Load distribution can be defined. The result of com- 
bining the two Omega distributions is a less severe compressive load 
than that of the Present System design (compare point A of the 
Omega 1 distribution with the combined Ultimate distribution) and 
a small tension requirement where the Present System has none 
(point B) . 
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Figure 27. Typical Spanwise Load Distribution at Body Station 
1500 for Combined Loads (QSDC Procedure) 


Thus, for the combined load situation, the QSDC Procedure 
creates understrength and overload strength requirements as in 
the single load situation. However, these strength requirements 
are interpreted as two distinct load distributions that must be 
sustained by the structure. The load distributions are the 
combined Limit Load distribution and the combined Omega Load 
distribution. 
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1 . 


INTRODUCTION 


The purpose of this study (NAS8-26918) is to provide recom- 
mendations for improved structural design criteria applicable to 
the Space Shuttle. To approach the problem logically, it is neces- 
sary to establish the objectives of the structural criteria. It is 
generally accepted that the major objective is to define operational 
conditions that the vehicle is required to survive without struc- 
tural failure. An adjunct to this objective is the specification 
of a proof of compliance procedure. This procedure must be accept- 
able for demonstrating that the structural system will survive the 
defined operational conditions. It is interesting to note that in 
NASA SP-8057 (Reference 1*) there is no quantitative definition of 
an objective. Neither is there one in MIL-A-8860 (Reference 2). 

Reference 3 developed the philosophy of a probabilistically 
based, deterministic system for defining structural design criteria. 
The concept is propounded that the structural system is expected 
to have both the capability of surviving overload situations and a 
reserve against understrength situations. Requirements for pro- 
viding these two capabilities are identified separately and ex- 
plicitly. These requirements are based on probabilistic consider- 
ations, but the resulting design conditions are established as 
deterministic requirements. This is the key to making the new 
procedure practical and administrable . 

This report is intended to summarize Reference 3 and together 
with Reference 4 describe the application of the Reference 3 con- 
cept to the Space Shuttle. To facilitate the understanding and 
acceptance of the Reference 3 concept, this report presents the 
basics of the concept in the briefest possible form for quick 
assimilation. Reference 4 expands the concept and discusses the 
rationale in more detail. Reference 5 presents engineering data 
and specific procedures for application of the concept to the struc- 
tural design of the Space Shuttle and other aerospace vehicles. 


* All references in Appendix A relate to listing on page A-20. 
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2 . 


GENERAL 


This report describes the concepts that define structural 
design criteria as developed in Reference 3. For simplicity and 
to differentiate from the Present System (typified by the 1.5 
Factor of Safety), this new procedure is designated as the QSDC 
Procedure (standing for Quantitative Structural Design Criteria 
by Probabilistic Methods). Although the QSDC Procedure was de- 
veloped for aircraft applications, it is universal and will be 
described in this summary in a context appropriate to the Space Shuttle. 

The methodology of the QSDC Procedure is presented in this 
summary in terms of the intent of the various steps. The imple- 
mentation of these intentions is described in detail in Refer- 
ences 4 and 5. 

All structural failures can be divided into two types: 
understrength or overload (see Figure 1). The line of demar- 
cation between the two is somewhat arbitrary. It depends on a 
decision defining those environmental conditions which will be 
imposed on the structural system by the nonstructural systems 
and which the structural system is expected to survive. In the 
QSDC Procedure the line of demarcation becomes a zone bounded 
by two discrete operational* conditions designated as the Limit 
Condition and the Omega Condition. As shown on Figure 2, these 
two conditions separate the entire range of severity of a par- 
ticular operational condition such as the longitudinal load fac- 
tor into three regions : 

1. The Safe Region 

2. The Overload Region 

3. The Gross Overload Region 

The Limit Condition is defined as the upper boundary of nor- 
mal and expected operations. This definition is considered to be 
satisfied in the QSDC Procedure if the Limit Condition is exceeded 
only once in one hundred vehicle lifetimes. In the initial design 
of a new vehicle such as the Space Shuttle, the decision on the 
magnitude of the Limit Condition is made on the basis of a proba- 
bilistic prediction of the lifetime operational spectra. If 


Hereafter, the environmental conditions which may be im- 
posed on the structural system by pilot actions, ground 
handling, hydraulic and pneumatic subsystems, aerodynamic 
heating and malfunctions will be called operational con- 
ditions for simplicity. 

This is for what is designated a Standard Vehicle in Refer- 
ence 3. Higher or lower values may be used for different 
missions but the principle remains unchanged. 
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Figure 1. Basic Fault Tree of Structural Failure Modes 
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Figure 2. Relationship of Limit/Omega Conditions to Operational Regions 


insufficient statistical data are available for a rational cal- 
culation of the Limit Condition, the decision is made on a judg- 
ment basis with the intent of satisfying the basic definition of 
a Limit Condition as the upper boundary of normal and expected 
operations . 

Once the decision is made, the defined Limit Condition (ini- 
tially chosen on a probabilistic basis) is deterministic and is 
no longer dependent on the method by which the decision was made. 

The choice is made somewhat self-fulfilling by establishing an 
Operational Limitation which coincides with the Limit Condition. 
Since the Limit Condition by definition is "expected,” it and all 
lesser conditions are not overloads. Since operations which ex- 
ceed the Operational Limitation are prohibited, any such exceed- 
ance is by definition an overload. These definitions are noted in 
Figure 2. The definitions of the Limit Condition and the Opera- 
tional Limitation are, for all practical purposes, the same as in 
the Present System. 

The QSDC Procedure defines a second level of operational con- 
dition severity that has been designated as the Omega Condition. 

This operational condition should be one that will be exceeded 
very rarely, if ever. In the QSDC Procedure the Omega Condition 
should be chosen so that the probability of exceedance is less than 
the complement of the Structural Reliability Goal. For the Standard 
Vehicle previously described, the Structural Reliability Goal is 
0.9999, so the probability of exceedance of the Omega Condition 
should be less than 0.0001. The same statistical data used for de- 
fining the Limit Condition should be used for making the prediction 
on which the Omega Condition decision is made. Again, if insuffi- 
cient statistical data are available for a rational prediction of 
the Omega Condition, the decision is made on a judgment basis. 

The choice should define a very rare operational condition. It 
should also represent a condition which is obviously a gross 
overload as noted on Figure 2, i.e,, well beyond the range of 
a minor penetration of the designated Operational Limitation. 
Finally, the Omega Condition should be one at which structural 
failure will be tolerated with the implication that the corrective 
action for such a failure will not be to strengthen the structural 
system but to change the nonstructural system to prevent future 
operations at or beyond the Omega Condition. 

The defined Limit and Omega Conditions establish an interface 
between the structural and nonstructural systems. Figure 2 and the 
previous discussion describe the relationship this interface im- 
poses on the nonstructural system. For the structural system, the 
Limit Condition represents an operational level below which "no" 
structural failure will be tolerated since such operations are 
within the Operational Limitation. "Most" of the vehicles should 
survive operations to the Omega level without structural failure, 
but no vehicles are required to survive beyond the Omega Condition. 
Since the Omega Condition is expected to occur once in 10,000 
vehicle lifetimes and less severe conditions more often, "most" 
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of the structural systems must survive this Omega Condition or 
the failure rate will be greater than 1:10000. In such cases 
the Structural Reliability Goal of 0.9999 could not be achieved. 

The relationship imposed by the Limit/Omega interface on the struc- 
tural system is shown on Figure 3. Any failure in the Gross Over- 
load Region, beyond the Omega Condition is, by definition, not an 
understrength failure. A failure at the Limit Condition is so far 
below the intended strength that it is by definition a "gross" 
understrength, and the corrective action is predetermined to be an 
increase in the strength of the structural system. 

A qualitative description of the characteristics of the three 
operational regions delimited by the Limit and Omega Conditions is 
presented on Figure 4. In the Safe Region, below the Limit Condi- 
tion, all operations are permissible and expected to be "safe" 
since they are below the Operational Limitation. Since operations 
in this region are expected to be safe, structural failure is not 
tolerated at or below the Limit Condition. If a failure does occur, 
it is by definition the result of a gross understrength in the struc 
tural system and the responsibility for the failure resides with the 
structural system. Operations beyond the Omega Condition in the 
Gross Overload Region are not to be tolerated because structural 
failure is "expected" in this region. Consequently, any failure 
is by definition a gross overload failure and the responsibility of 
the nonstructural system that produced the Omega Condition. 

The Overload Region between the Limit and Omega Conditions is 
a transitional region. An occasional violation and penetration of 
the Operational Limitation will be tolerated, although not approved. 
Because a realistic assessment of the situation must recognize 
that violations of the Operational Limitations will occur periodi- 
cally, some structural capability must be provided to survive these 
occasional penetrations into the region beyond the Limit Condition. 
This requirement is qualitatively described by stating that most, 
but not all, of the structures must survive in this Overload Re- 
gion. It should be noted that any penetration of the Operational 
Limitation results in an overload, but the magnitude of the overload 
varies from a minor overload as soon as the Operational Limitation 
is exceeded to a gross overload if the entire region is traversed 
and the Omega Condition is attained. In a similar vein, any failure 
at less than the Omega Condition represents an understrength situa- 
tion which varies from a minor understrength at the Omega Condition 
to a gross understrength if failure occurs at the Limit Condition. 
Thus, there is a gradual shifting of responsibility for a structural 
failure in the Overload Region from the structural system to the 
nonstructural system as the level at which the failure occurs in- 
creases from the Limit Condition to the Omega Condition. 

The requirements for preventing failure in all three regions 
are satisfied if four requirements which are related to the Limit 
and Omega Conditions and described below are satisfied. As dis- 
cussed previously and as shown on Figure 5, the Limit and Omega 
Conditions should be chosen and operations controlled so that 
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Figure 5. Fault Tree for Structural Failure Prevention 
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there are few exceedances of the Limit Condition and very rare 
exceedances of the Omega Condition. The strength of the struc- 
tural system should range from "no" failure at the Limit Condi- 
tion to "most" structural systems capable of surviving the Omega 
Condition. If these four separate requirements are satisfied, 
the structural failure rate will approximate the frequency of ex- 
ceedance of the Omega Condition. In addition, most of the failures 
will be the result of gross overloads and only a small percentage 
of the failures will be the result of gross understrengths. This 
latter objective stems from the fact that past, experience shows 
that understrength failures are considered to be less acceptable 
than overload failures. 

A simple Space Shuttle example which illustrates how these 
qualitative requirements are satisfied is presented on Figure 6. 
The figure shows the increase in longitudinal load factor with 
time (due to a decrease in remaining propellant) . This load fac- 
tor could increase to such a high value that d significant weight 
penalty would be incurred in the design. As a result, present 
Space Shuttle designs throttle back the engines to restrict the 
longitudinal load factor to some predetermined value, taken to be 
3.0G in this example. To define the Limit and Omega Conditions, 
an analytical prediction must be made concerning the precision 
with which the propulsion control system can establish the nomi- 
nal 3.0G on each launch. As shown on Figure 6, the hypothetical 
scatter in thrust cutoffs will result in a 3.15G load factor on 
1:100 vehicles during their lifetime. A 3 . 6G load factor is pre- 
dicted to occur in 1:10000 vehicle lifetimes. These predictions 
may be made by any rational engineering technique. Judgment may 
be a major element in the prediction (as it was in this example). 
However arrived at, the prediction becomes the basis for the de- 
cision that the Limit Condition is 3.15G and the Omega Condition 
is 3.6G. From this point on, the Limit/Omega Conditions are de- 
terministic. 

A discussion on how the decision should be validated is pre- 
sented in Reference 4. However, the basic considerations should 
be that the propulsion control system and those organizations 
responsible for it agree that they can hold the longitudi- 
nal load factor to 3.15G "most" of the time and 3.6G "all" of the 
time. They and presumably the Program Manager agree that, if the' 
load factor exceeds 3.15G on any launch, an investigation will be 
initiated to determine the cause of the overload and the necessary 
preventative action. Also, the manager of the propulsion control 
system and the Program Manager agree in advance that, if the load 
factor ever exceeds 3.6G and structural failure follows, the cor- 
rective action will be to modify the propulsion control system 
rather than to strengthen the structural system. 

In short, the decision on the magnitude of the Limit and 
Omega Conditions should be based on probabilistic considerations 
whenever possible and on good judgement when no data is available. 
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Figure 6. Example- -Boost Longitudinal Load Factor by QSDC Procedure 




The choice is confirmed and accepted by all concerned. From 
that time forward any exceedance of the Limit Condition of 3.15G 
will be recognized r as an unacceptable operation which overloads 
the structural system. Corrective action is promised to prevent 
any future penetration into the overload region beyond the 3.15G 
Limit Condition. Finally, it is agreed by all concerned that 
any operation beyond the 3.6G Omega Condition is expected to re- 
sult in structural failure so that prevention of such a gross 
overload is a necessity if structural failure in the Gross Overload 
Region is to be prevented. 

Once it is decided that the Limit Condition for the longi- 
tudinal load factor of the Space Shuttle is 3.15G and that the 
Omega Condition is 3.6G, the structural system in each flight 
vehicle must satisfy two separate and distinct requirements. 

The region below 3.15G must be a safe region as shown on Figure 6 
with no structural failure tolerated in this region. Note that 
this requirement is valid regardless of the methodology used to 
establish the Limit Condition of 3.15G and regardless of whether . 
the defined Limit Condition satisfies the specified requirements. 

Once the number representing Limit Condition (3.15G) is defini- 
tized, that number represents the upper boundary of what must be 
safe and permissible operations. 

The second requirement for the structural system of each 
Space Shuttle is that most of these structural systems should 
survive an excursion of boost longitudinal load factor to 3.6G. 

Note that in meeting this requirement some capability beyond 
Omega is inevitably provided. However, no commitment is estab- 
lished to provide any specific level of survival beyond Omega, 
provided that "most" survive Omega. The structure is "expected" 
to fail in the region beyond Omega. The characteristics ex- 
pected of the structural system are summarized on Figure 4. 

The structural requirements of "no" failure at Limit and "most" 
survive at Omega are provided by two separate strength require- 
ments. As shown on Figure 7, a reserve to provide against under- 
strength sufficient to cause failure at the Limit Condition is 
provided by establishing a Design Load for Limit Condition which 
is higher than the load at the Limit Condition. The magnitude 
of this reserve will depend on the magnitude of the strength 
scatter of the particular structure involved, the number of 
strength tests on separate and independent test structures sub- 
jected to the Design Load for the Limit Condition, and the risk 
level dictated by the vehicle mission. Figure 8 defines a factor 
called the Limit Design and Test Factor of Safety (LTFS) which is 
sufficient to achieve the desired result. 

The rationale of the LTFS is described in detail in Refer- 
ence 4. The LTFS is used in the same manner as the 1.5 Factor 
of Safety in the Present System. However, the LTFS is determined 
by the increment in the test load necessary to reject all under- 
strength designs which might result in structural failures during oper- 
ations at or below the Limit Condition. It is a basic premise of 


A - 14 



OTFS — | r DESIGN LOAD 

OMEGA (3. 6 G) 1 \ FOR OMEGA CONDITION 



A - 15 


Figure 7. Overload and Understrength Requirements 
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the QSDC Procedure that understrength designs have occurred in 
the past and may be expected to occur again in the future when 
the design strength is predicted by analysis alone. 

Strength tests such as static tests of a test article con- 
sidered to be representative of the flight articles have been 
considered for many years as a major element in the development 
of reliable structural systems. The QSDC Procedure continues 
this reliance on testing but changes the rationalization for 
the test. Most structural engineers have grown accustomed to 
thinking that the test "proves" the strength of the design. 

This assumption is not correct for reasons discussed in Refer- 
ences 3 and 4. The test may be used as a contractual or ad- 
ministrative basis for the acceptance of the design, but it does 
not prove the strength. In the QSDC Procedure the test is used 
as a means for disclosing errors in the analysis. If the test 
article fails to support the test loads, the design is rejected. 

However, some designs that should be rejected pass the test and 
others that should be accepted fail to pass the test. 

The problem is that the strengths of a group of nominally 
identical structures of a given design are randomly distributed. 

The test article may be higher or lower in strength than the 
average strength of the flight articles. As a result, a test 
article on the low side of the average strength may result in 
falsely rejecting a "good" design. This possibility is unfor- 
tunate because of the cost and schedule delay involved, but the 
redesign for greater strength will result in changing a design 
which is already adequate to one which is more reliable than 
required. Thus, the impact on the reliability performance of 
the structural system would be beneficial. 

But if the test article is on the high side of the average 
strength, the successful test may result in falsely accepting a 
"bad" design. This latter phenomenon is sometimes known as "ran- 
dom success." If the strength scatter of the design is small, the 
range will be quite narrow between flight articles on the low side 
of the scatter band and a possible random success of the test arti- 
cle on the high side of the scatter band. Thus, a small LTFS will 
be quite adequate to insure a very low possibility of failure under 
the load at the Limit Condition after successful test to the higher 
design and test load defined by the LTFS. 

It appears that the strength scatter of most aerospace struc- 
tures designed in the past in accordance with good practice was 
small enough so that the usual 1.5 Factor of Safety inherently 
provided a more than adequate reserve against understrength; conse- 
quently, the problem has not been recognized in the past. Certain 
types of designs that were intuitively recognized as having large 
scatter (usually vocalized as being inconsistent or erratic in strength) 
were proscribed in aerospace practice. Brittle materials such as 
ceramics, extremely high heat treats in steels, and welds in 
tension were avoided as were very long slender columns. Trends in 
structural systems indicate that these types of designs are becoming 
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more necessary to meet the demands of advanced systems such as 
the Space Shuttle. In such cases an LTFS greater than 1.5 may 
be necessary to maintain the desired structural integrity. On 
the other hand, the requirement for a low-cost transportation 
system such as the Space Shuttle demands that the criteria re- 
quirements be reduced to a minimum to obtain the lightest pos- 
sible structural system. The definition of an LTFS in the format 
of Figure 8 permits the designer to use an LTFS less than 1.5 if 
he can select materials and configurations with a low strength 
scatter. When the exigencies of the mission requirements de- 
mand structures with a large strength scatter, the larger LTFS 
required to provide safety in the region below the Limit Condi- 
tion is called out by Figure 8. 

As described above and as shown on Figure 8, the reserve 
against understrength may be large or small depending on the 
structural configuration. The requirement for overload capa- 
bility as shown on Figure 7 is separate and distinct from the 
requirement for an understrength reserve. There is no factorial 
relationship between the Design Load for the Omega Condition and 
that for the Limit Condition. For example, the Limit Load for 
a vacuum tank designed to operate at sea level would be 14.7 
pounds per square inch. Since overpressure could never occur in 
this situation, the Omega Load would also be 14.7 pounds per 
square inch. The Design Load for the Omega Condition would be 
14.7 pounds per square inch, but the Design Load for the Limit 
Condition would vary. If the strength scatter were small, the 
LTFS might be 1.25 in which case the Design Load for the Limit 
Condition would be 18.38 pounds per square inch. If the strength 
scatter were large, the LTFS might be 2.1 in which case the Design 
Load for the Limit Condition would be 30.87 pounds per square inch 
In either case, the Design Load for the Limit Condition would be 
more critical than the Design Load for the Omega Condition. On 
the other hand, some overload situations may result in an Omega 
Load which is two or three times larger than the Limit Load. Fur- 
ther complicating the problem of providing overload capability is 
the variation of temperature and other environmental loads between 
Limit and Omega Conditions. It is quite possible that the mechan- 
ical load at the Omega Condition may be little more than that for 
the Limit Condition; yet the associated thermal environment may 
make the Omega Condition much more critical. In any event, the 
objective for the structural design is to produce a structural sys 
tern which will survive the Omega Condition in most of the vehicles 
Temperature, radiation, corrosion, and other environments which 
occur simultaneous to the Omega Condition must be considered in 
determining survival capability. 

The final result is a structural system which will possess 
an adequate but not excessive provision against the four modes 
of failure shown on Figure 5. This in turn will prevent failures 
in each of the three operational regions shown on Figure 9, which 
combines the definitions of Figures 2 and 3 for easy reference. 
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APPENDIX B 
ERROR ANALYSIS 


B.l Introduction 


This appendix is included to give the proper perspective to 
the problems created by design errors in the development of a new 
piece of hardware such as the Space Shuttle. The design errors 
considered are load errors and strength errors. The load errors 
considered are errors in the choice of the design condition and 
errors in the conversion of operational conditions to external load. 
The strength errors considered are the analytical errors made in 
sizing and errors in the material strength, such as heat-treat 
errors. The impact of these errors on the overall reliability 
of the structure is discussed. 

The QSDC Procedure, as presented in the report proper and 
summarized in Appendix A, is used here. The manner in which the 
QSDC Procedure deals with each type of error is also discussed. 

The justification of the need to consider the possible errors is 
presented briefly according to the Jablecki/Chenoweth data of Fig- 
ure B-2 and supplementary data of Figure B-3. These figures are 
presented as representative of the true state of the art of analysis. 

B.2.1 Loads Errors 

Load errors are defined as those arising when the exter- 
nal loads are not consistent with the design conditions or those 
arising when the design conditions, although interpreted correctly 
as external loads, are not consistent with the actual mission re- 
quirements; that is, either the design condition is right but the 
conversion to external loads is incorrect or the choice of the de- 
sign condition is in error. An example of the latter would be the 
error resulting from ignoring the across -the-fleet variation in 
the design condition. Suppose that the maximum gimbal angle de- 
flection is specified as 7 degrees. This might be used as a Limit 
Condition which may become the design condition (if the loads 
associated with the Limit Condition are the more critical). If 
the across-the-fleet variation is on the order of one degree, then 
the choice of the Limit Condition may be in error by as much as 

1.0 degree. Thus, the Limit Condition should be specified as 8.0 
degrees. If the loading in the component, say diagonal members of 
the thrust structure, is a linear function of the condition inves- 
tigated, say gimbal angle, then the design loads for the 7-degree 
limit will be less than the loads required for the actual limit of 

8.0 degrees. In the QSDC Procedure, this type of error is excluded 
because the choice of the Limit and Omega Conditions is made with 
consideration of the variability of the condition. The Limit Con- 
dition becomes a placard value, that is, it is not to be exceeded. 
Exceedances , however, do occur even though it is specified by regu- 
lation that it is not to be exceeded. When these exceedances occur 
in the pursuit of the design mission, there is evidence that the 
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the design condition is too low and hence in error. 

The second form of design error is the most common: an 

error in the conversion of operating conditions to external 
loads. This error is most commonly an analytical one made in 
the numerical analysis. For example, suppose that the 8.0- 
degree gimbal angle Limit Condition is chosen. Hypothetically, 
the loads analysis shows that on some diagonal member in the 
thrust structure the load is 50,000 pounds compression at this 
Limit Condition. The results of operations monitoring might 
show that the load on the same member is actually 55,725 pounds 
for the Limit Condition of 8 degrees of gimbal. Thus, it 
could be said that the interpretation of the Limit Condition as 
an external load was in error, although the Limit Condition was 
properly chosen. 

It should be noted that the loads errors cannot be detected 
until the vehicle is in operation and the data from the operations 
monitoring has been observed. The exceedance of the placard Limit 
in the pursuit of the mission requirements must be detected, and 
the external loads must be measured directly. The condition and 
load levels are then correlated. Usually this correlation can be 
made during the flight loads program. Due to the placement of 
the flight loads program at the beginning of the production phase, 
there can be no validation of the loads analysis until the flight 
loads program is over. As a result of this time lag, there is a 
tendency to be conservative in the loads analysis to compensate 
for possible errors. 

However, the problems that arise from designing for error 
may be worse than the one it is intended to cure. There is the 
possibility of either type of error in the loads program creating 
schedule delays and cost over-runs, not to mention the resulting 
understrength of the structure. In designing for error, a factor 
is applied to the load that is possibly in error. Here the re- 
sult is higher weight and thus higher cost. The designer's option 
is either to ignore the possibility of error in the loads and 
suffer the possible schedule delays and the possible increased 
cost or to design for the possible error and pay the price of 
increased weight and cost. The QSDC Procedure does not- ignore 
the possibility of loads errors, nor does it design for them. 

The fallacy in designing for error is that the magnitude of the . 
error cannot be known in advance of its occurrence so that the 
factor applied to the load to account for the error is hypothet- 
ical at best. In short, the designer is faced with the problem 
of how much of an error should the design be accountable for? 
Obviously, no specific value can be chosen. For example, the de- 
signer might decide to account for possible errors in the design 
by using an "error factor" of 2.0. However, if a decimal point 
error occurs, this "error factor" would be inadequate. In the QSDC 
the assumption of the magnitude of the error is recognized as in- 
effective; consequently, the approach is to be aware of the possible 
error, monitor the actual operations to detect the possible errors, 
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and redesign if they do occur. This is essentially the practice 
followed in the Present System. 

B.2.2 Strength Errors 

Strength errors are defined as those arising when 
the strength of the structure is less than the strength required 
to survive the design conditions. The strength required to 
survive the design conditions will be termed .the conditional 
strength. The conditional strength distribution is the distri- 
bution predicted as in Figure B-l. The lower strength distribu- 
tion is the result of a strength error. An example would be an 
error in the dimension of a critical part. Suppose that the 
lower fuselage skin is critically loaded in tension. The strength 
analysis has shown that a skin thickness of 0.090 inches is suf- 
ficient for the design when, in fact, 0.120 inch-sheet is required 
As a result, the strength of the 0.090 fuselage skin will be 25 
percent less than that required. Similarily, a missing heat-treat 
note will also create an understrength design. After the fabri- 
cation of the prototype structure, the existence of the strength 
error or understrength design is not known. Unlike the load error 
the strength error can be disclosed with a degree of certainty 
by qualification testing to the design loads that characterize 
the conditional strength requirement. Thus the qualification 
test is a conditional strength test, and the reliability demon- 
strated is a conditional reliability as discussed in References 
1 and 5.* The conditions on the reliability are: 

1) that the external and internal loads in service 
are the same as the predicted values in design, 

2) that the Limit and Omega Conditions are properly 
chosen, and 

3) that the structure is used in its design mission. 

If these conditions are met, then the conditional reliability 
will be the actual reliability of the structure in service. 

The need for testing for the conditional strength require- 
ment has been demonstrated by the Jablecki/Chenoweth data of 
Figure B-2. Here, the expectancy of failure, in percent, is 
plotted versus the percent of ultimate load supported. This 
curve represents the inability of the design analysis to pro- 
vide the required strength (100 percent ultimate) for the first 
time static tests. The data also represents qualitatively the 
ability of the static test to disclose the understrength designs. 
More recent in published data, Figure B-3 has shown that there 
has been little improvement in the results of the analysis since 
the time of the Jablecki/Chenoweth data. These data have been 
employed in the computer programs of Reference 1 to define the 
probability that the mean strength of the design, as typified 


* All references in Appendix B relate to listing on page 76 in 
report proper. 
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PERCENT OF ULTIMATE LOAD SUPPORTED 



FAILURE EXPECTANCY IN PERCENT 

gure B-2 Jablecki/Chenoweth Data on the Failure of Wing 
Structures (Reference 3) 







PERCENT OF ULTIMATE LOAD SUPPORT 



Figure B-3 Unpublished Data on the Failing Loads of Wing 
Structure in Static Tests (Reference 4) 
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by the test article, is a percentage of the intended design 
strength. Utilizing this information in the calculation of 
the reliability of the structure is markedly different from 
that of other proposed methods where the reliability is pres- 
ently calculated from the interaction of the tails of the load 
and strength distributions (Reference 9) . In calculating the 
reliability in this manner, the assumption is made that the 
location of the strength distribution is known. This is not 
the real-life situation as evidenced by the Jablecki/Chenoweth 
data. The real situation indicates that the reliability is 
much more strongly dependent on the possible location of the 
actual strength distribution at levels below the predicted 
value than on the interaction of the tails of the strength 
and load distributions. 
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